diff --git a/thys/Independence_CH/Cardinal_Preservation.thy b/thys/Independence_CH/Cardinal_Preservation.thy
--- a/thys/Independence_CH/Cardinal_Preservation.thy
+++ b/thys/Independence_CH/Cardinal_Preservation.thy
@@ -1,488 +1,481 @@
 section\<open>Preservation of cardinals in generic extensions\<close>
 
 theory Cardinal_Preservation
   imports
     Forcing_Main
 begin
 
 context forcing_data1
 
 begin
 
 lemma antichain_abs' [absolut]:
-  "\<lbrakk> A\<in>M \<rbrakk> \<Longrightarrow> antichain\<^bsup>M\<^esup>(P,leq,A) \<longleftrightarrow> antichain(P,leq,A)"
+  "\<lbrakk> A\<in>M \<rbrakk> \<Longrightarrow> antichain\<^bsup>M\<^esup>(\<bbbP>,leq,A) \<longleftrightarrow> antichain(\<bbbP>,leq,A)"
   unfolding antichain_rel_def antichain_def compat_def
   using transitivity[of _ A]
   by (auto simp add:absolut)
 
 lemma inconsistent_imp_incompatible:
-  assumes "p \<tturnstile> \<phi> env" "q \<tturnstile> Neg(\<phi>) env" "p\<in>P" "q\<in>P"
+  assumes "p \<tturnstile> \<phi> env" "q \<tturnstile> Neg(\<phi>) env" "p\<in>\<bbbP>" "q\<in>\<bbbP>"
     "arity(\<phi>) \<le> length(env)" "\<phi> \<in> formula" "env \<in> list(M)"
   shows "p \<bottom> q"
 proof
   assume "compat(p,q)"
   then
-  obtain d where "d \<preceq> p" "d \<preceq> q" "d \<in> P" by blast
+  obtain d where "d \<preceq> p" "d \<preceq> q" "d \<in> \<bbbP>" by blast
   moreover
   note assms
   moreover from calculation
   have "d \<tturnstile> \<phi> env" "d \<tturnstile> Neg(\<phi>) env"
     using strengthening_lemma by simp_all
   ultimately
   show "False"
     using Forces_Neg[of d env \<phi>] refl_leq
     by (auto dest:transitivity; drule_tac bspec; auto dest:transitivity)
 qed
 
 notation check (\<open>_\<^sup>v\<close> [101] 100)
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 
 locale G_generic2 = G_generic1 + forcing_data2
 locale G_generic2_AC = G_generic1_AC + G_generic2
 
 locale G_generic3 = G_generic2 + forcing_data3
 locale G_generic3_AC = G_generic2_AC + G_generic3
 
 locale G_generic3_AC_CH = G_generic3_AC + M_ZFC2_ground_CH_trans
 
 sublocale G_generic3_AC \<subseteq> ext:M_ZFC2_trans "M[G]"
   using ground_replacements3 replacement_assm_MG
   by unfold_locales simp_all
 
 lemma (in forcing_data1) forces_neq_apply_imp_incompatible:
   assumes
     "p \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b\<^sup>v]"
     "q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b'\<^sup>v]"
     "b \<noteq> b'"
     \<comment> \<open>More general version: taking general names
        \<^term>\<open>b\<^sup>v\<close> and \<^term>\<open>b'\<^sup>v\<close>, satisfying
        \<^term>\<open>p \<tturnstile> \<cdot>\<not>\<cdot>0 = 1\<cdot>\<cdot> [b\<^sup>v, b'\<^sup>v]\<close> and
        \<^term>\<open>q \<tturnstile> \<cdot>\<not>\<cdot>0 = 1\<cdot>\<cdot> [b\<^sup>v, b'\<^sup>v]\<close>.\<close>
     and
-    types:"f\<in>M" "a\<in>M" "b\<in>M" "b'\<in>M" "p\<in>P" "q\<in>P"
+    types:"f\<in>M" "a\<in>M" "b\<in>M" "b'\<in>M" "p\<in>\<bbbP>" "q\<in>\<bbbP>"
   shows
     "p \<bottom> q"
 proof -
   {
     fix G
     assume "M_generic(G)"
     then
     interpret G_generic1 _ _ _ _ _ G by unfold_locales
     include G_generic1_lemmas
     assume "q\<in>G"
     with assms \<open>M_generic(G)\<close>
     have "M[G], map(val(G),[f,a,b'\<^sup>v]) \<Turnstile> \<cdot>0`1 is 2\<cdot>"
       using truth_lemma[of "\<cdot>0`1 is 2\<cdot>" "[f,a,b'\<^sup>v]"]
       by (auto simp add:ord_simp_union arity_fun_apply_fm
           fun_apply_type)
     with \<open>b \<noteq> b'\<close> types
     have "M[G], map(val(G),[f,a,b\<^sup>v]) \<Turnstile> \<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot>"
       using GenExtI by auto
   }
   with types
   have "q \<tturnstile> \<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot> [f,a,b\<^sup>v]"
     using definition_of_forcing[where \<phi>="\<cdot>\<not>\<cdot>0`1 is 2\<cdot>\<cdot>" ]
     by (auto simp add:ord_simp_union arity_fun_apply_fm)
   with \<open>p \<tturnstile> \<cdot>0`1 is 2\<cdot> [f,a,b\<^sup>v]\<close> and types
   show "p \<bottom> q"
     using inconsistent_imp_incompatible
     by (simp add:ord_simp_union arity_fun_apply_fm fun_apply_type)
 qed
 
 context M_ctm2_AC
 begin
 
 \<comment> \<open>Simplifying simp rules (because of the occurrence of
    \<^term>\<open>setclass\<close>)\<close>
 lemmas sharp_simps = Card_rel_Union Card_rel_cardinal_rel Collect_abs
   Cons_abs Cons_in_M_iff Diff_closed Equal_abs Equal_in_M_iff Finite_abs
   Forall_abs Forall_in_M_iff Inl_abs Inl_in_M_iff Inr_abs Inr_in_M_iff
   Int_closed Inter_abs Inter_closed M_nat Member_abs Member_in_M_iff
   Memrel_closed Nand_abs Nand_in_M_iff Nil_abs Nil_in_M Ord_cardinal_rel
   Pow_rel_closed Un_closed Union_abs Union_closed and_abs and_closed
   apply_abs apply_closed bij_rel_closed bijection_abs bool_of_o_abs
   bool_of_o_closed cadd_rel_0 cadd_rel_closed cardinal_rel_0_iff_0
   cardinal_rel_closed cardinal_rel_idem cartprod_abs cartprod_closed
   cmult_rel_0 cmult_rel_1 cmult_rel_closed comp_closed composition_abs
   cons_abs cons_closed converse_abs converse_closed csquare_lam_closed
   csquare_rel_closed depth_closed domain_abs domain_closed eclose_abs
   eclose_closed empty_abs field_abs field_closed finite_funspace_closed
-  finite_ordinal_abs formula_N_abs formula_N_closed formula_abs
-  formula_case_abs formula_case_closed formula_closed
-  formula_functor_abs fst_closed function_abs function_space_rel_closed
+  finite_ordinal_abs fst_closed function_abs function_space_rel_closed
   hd_abs image_abs image_closed inj_rel_closed injection_abs inter_abs
-  irreflexive_abs is_depth_apply_abs is_eclose_n_abs is_funspace_abs
-  iterates_closed length_abs length_closed lepoll_rel_refl
-  limit_ordinal_abs linear_rel_abs list_N_abs list_N_closed list_abs
-  list_case'_closed list_case_abs list_closed list_functor_abs
-  mem_bij_abs mem_eclose_abs mem_inj_abs mem_list_abs membership_abs
+  irreflexive_abs is_eclose_n_abs is_funspace_abs
+  iterates_closed length_closed lepoll_rel_refl
+  limit_ordinal_abs linear_rel_abs
+  mem_bij_abs mem_eclose_abs mem_inj_abs membership_abs
   minimum_closed nat_case_abs nat_case_closed nonempty not_abs
-  not_closed nth_abs number1_abs number2_abs number3_abs omega_abs
+  not_closed number1_abs number2_abs number3_abs omega_abs
   or_abs or_closed order_isomorphism_abs ordermap_closed
   ordertype_closed ordinal_abs pair_abs pair_in_M_iff powerset_abs
   pred_closed pred_set_abs quasilist_abs quasinat_abs radd_closed
   rall_abs range_abs range_closed relation_abs restrict_closed
   restriction_abs rex_abs rmult_closed rtrancl_abs rtrancl_closed
   rvimage_closed separation_closed setdiff_abs singleton_abs
   singleton_in_M_iff snd_closed strong_replacement_closed subset_abs
   succ_in_M_iff successor_abs successor_ordinal_abs sum_abs sum_closed
   surj_rel_closed surjection_abs tl_abs trancl_abs trancl_closed
   transitive_rel_abs transitive_set_abs typed_function_abs union_abs
   upair_abs upair_in_M_iff vimage_abs vimage_closed well_ord_abs
-  mem_formula_abs nth_closed Aleph_rel_closed csucc_rel_closed
+  nth_closed Aleph_rel_closed csucc_rel_closed
   Card_rel_Aleph_rel
 
 declare sharp_simps[simp del, simplified setclass_iff, simp]
 
 lemmas sharp_intros = nat_into_M Aleph_rel_closed Card_rel_Aleph_rel
 
 declare sharp_intros[rule del, simplified setclass_iff, intro]
 
 end \<comment> \<open>\<^locale>\<open>M_ctm2_AC\<close>\<close>
 
 context G_generic3_AC begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemmas mg_sharp_simps = ext.Card_rel_Union ext.Card_rel_cardinal_rel
   ext.Collect_abs ext.Cons_abs ext.Cons_in_M_iff ext.Diff_closed
   ext.Equal_abs ext.Equal_in_M_iff ext.Finite_abs ext.Forall_abs
   ext.Forall_in_M_iff ext.Inl_abs ext.Inl_in_M_iff ext.Inr_abs
   ext.Inr_in_M_iff ext.Int_closed ext.Inter_abs ext.Inter_closed
   ext.M_nat ext.Member_abs ext.Member_in_M_iff ext.Memrel_closed
   ext.Nand_abs ext.Nand_in_M_iff ext.Nil_abs ext.Nil_in_M
   ext.Ord_cardinal_rel ext.Pow_rel_closed ext.Un_closed
   ext.Union_abs ext.Union_closed ext.and_abs ext.and_closed
   ext.apply_abs ext.apply_closed ext.bij_rel_closed
   ext.bijection_abs ext.bool_of_o_abs ext.bool_of_o_closed
   ext.cadd_rel_0 ext.cadd_rel_closed ext.cardinal_rel_0_iff_0
   ext.cardinal_rel_closed ext.cardinal_rel_idem ext.cartprod_abs
   ext.cartprod_closed ext.cmult_rel_0 ext.cmult_rel_1
   ext.cmult_rel_closed ext.comp_closed ext.composition_abs
   ext.cons_abs ext.cons_closed ext.converse_abs ext.converse_closed
   ext.csquare_lam_closed ext.csquare_rel_closed ext.depth_closed
   ext.domain_abs ext.domain_closed ext.eclose_abs ext.eclose_closed
   ext.empty_abs ext.field_abs ext.field_closed
-  ext.finite_funspace_closed ext.finite_ordinal_abs ext.formula_N_abs
-  ext.formula_N_closed ext.formula_abs ext.formula_case_abs
-  ext.formula_case_closed ext.formula_closed ext.formula_functor_abs
+  ext.finite_funspace_closed ext.finite_ordinal_abs
   ext.fst_closed ext.function_abs ext.function_space_rel_closed
   ext.hd_abs ext.image_abs ext.image_closed ext.inj_rel_closed
   ext.injection_abs ext.inter_abs ext.irreflexive_abs
-  ext.is_depth_apply_abs ext.is_eclose_n_abs ext.is_funspace_abs
-  ext.iterates_closed ext.length_abs ext.length_closed
+  ext.is_eclose_n_abs ext.is_funspace_abs
+  ext.iterates_closed ext.length_closed
   ext.lepoll_rel_refl ext.limit_ordinal_abs ext.linear_rel_abs
-  ext.list_N_abs ext.list_N_closed ext.list_abs
-  ext.list_case'_closed ext.list_case_abs ext.list_closed
-  ext.list_functor_abs ext.mem_bij_abs ext.mem_eclose_abs
-  ext.mem_inj_abs ext.mem_list_abs ext.membership_abs
+  ext.mem_bij_abs ext.mem_eclose_abs
+  ext.mem_inj_abs ext.membership_abs
   ext.nat_case_abs ext.nat_case_closed
-  ext.nonempty ext.not_abs ext.not_closed ext.nth_abs
+  ext.nonempty ext.not_abs ext.not_closed
   ext.number1_abs ext.number2_abs ext.number3_abs ext.omega_abs
   ext.or_abs ext.or_closed ext.order_isomorphism_abs
   ext.ordermap_closed ext.ordertype_closed ext.ordinal_abs
   ext.pair_abs ext.pair_in_M_iff ext.powerset_abs ext.pred_closed
   ext.pred_set_abs ext.quasilist_abs ext.quasinat_abs
   ext.radd_closed ext.rall_abs ext.range_abs ext.range_closed
   ext.relation_abs ext.restrict_closed ext.restriction_abs
   ext.rex_abs ext.rmult_closed ext.rtrancl_abs ext.rtrancl_closed
   ext.rvimage_closed ext.separation_closed ext.setdiff_abs
   ext.singleton_abs ext.singleton_in_M_iff ext.snd_closed
   ext.strong_replacement_closed ext.subset_abs ext.succ_in_M_iff
   ext.successor_abs ext.successor_ordinal_abs ext.sum_abs
   ext.sum_closed ext.surj_rel_closed ext.surjection_abs ext.tl_abs
   ext.trancl_abs ext.trancl_closed ext.transitive_rel_abs
   ext.transitive_set_abs ext.typed_function_abs ext.union_abs
   ext.upair_abs ext.upair_in_M_iff ext.vimage_abs ext.vimage_closed
-  ext.well_ord_abs ext.mem_formula_abs ext.nth_closed ext.Aleph_rel_closed
+  ext.well_ord_abs ext.nth_closed ext.Aleph_rel_closed
   ext.csucc_rel_closed ext.Card_rel_Aleph_rel
 
 \<comment> \<open>The following was motivated by the fact that
     @{thm [source] ext.apply_closed} did not simplify appropriately.\<close>
 declare mg_sharp_simps[simp del, simplified setclass_iff, simp]
 
 lemmas mg_sharp_intros = ext.nat_into_M ext.Aleph_rel_closed
   ext.Card_rel_Aleph_rel
 
 declare mg_sharp_intros[rule del, simplified setclass_iff, intro]
 
 \<comment> \<open>Kunen IV.2.31\<close>
 lemma forces_below_filter:
   assumes "M[G], map(val(G),env) \<Turnstile> \<phi>" "p \<in> G"
     "arity(\<phi>) \<le> length(env)" "\<phi> \<in> formula" "env \<in> list(M)"
   shows "\<exists>q\<in>G. q \<preceq> p \<and> q \<tturnstile> \<phi> env"
 proof -
   note assms
   moreover from this
   obtain r where "r \<tturnstile> \<phi> env" "r\<in>G"
     using generic truth_lemma[of \<phi> env]
     by blast
   moreover from this and \<open>p\<in>G\<close>
   obtain q where "q \<preceq> p" "q \<preceq> r" "q \<in> G" by auto
   ultimately
   show ?thesis
     using strengthening_lemma[of r \<phi> _ env] by blast
 qed
 
 subsection\<open>Preservation by ccc forcing notions\<close>
 
 lemma ccc_fun_closed_lemma_aux:
   assumes "f_dot\<in>M" "p\<in>M" "a\<in>M" "b\<in>M"
-  shows "{q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))} \<in> M"
+  shows "{q \<in> \<bbbP> . q \<preceq> p \<and> (M, [q, \<bbbP>, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))} \<in> M"
   using separation_forces[where env="[f_dot, a\<^sup>v, b\<^sup>v]" and \<phi>="\<cdot>0`1 is 2\<cdot>",simplified]
     assms G_subset_M[THEN subsetD] generic
     separation_in lam_replacement_constant lam_replacement_identity
     lam_replacement_product
     separation_conj arity_fun_apply_fm union_abs1
   by simp_all
 
 lemma ccc_fun_closed_lemma_aux2:
   assumes "B\<in>M" "f_dot\<in>M" "p\<in>M" "a\<in>M"
-  shows "(##M)(\<lambda>b\<in>B. {q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
+  shows "(##M)(\<lambda>b\<in>B. {q \<in> \<bbbP> . q \<preceq> p \<and> (M, [q, \<bbbP>, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
 proof -
-  have "separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
+  have "separation(##M, \<lambda>z. M, [snd(z), \<bbbP>, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
     if "\<tau>\<in>M" for \<tau>
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),fst_fm,2,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_fun_apply_fm union_abs1 arity_forces[of "\<cdot>0`1 is 2\<cdot> "]
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function assms that sats_fst_fm
         snd_abs sats_snd_fm sats_check_fm check_abs fst_abs
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using lam_replacement_imp_lam_closed separation_conj separation_in
       lam_replacement_product lam_replacement_constant transitivity[of _ B]
       lam_replacement_snd lam_replacement_Collect' ccc_fun_closed_lemma_aux
     by simp
 qed
 
 lemma ccc_fun_closed_lemma:
   assumes "A\<in>M" "B\<in>M" "f_dot\<in>M" "p\<in>M"
-  shows "(\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}) \<in> M"
+  shows "(\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>\<bbbP>. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}) \<in> M"
 proof -
-  have "separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, fst(fst(z))\<^sup>v, snd(fst(z))\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
+  have "separation(##M, \<lambda>z. M, [snd(z), \<bbbP>, leq, \<one>, f_dot, fst(fst(z))\<^sup>v, snd(fst(z))\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g="\<lambda>z . fst(fst(fst(z)))\<^sup>v"
     let ?g_fm="hcomp_fm(check_fm(6),hcomp_fm(fst_fm,fst_fm),2,0)"
     let ?h_fm="hcomp_fm(check_fm(7),hcomp_fm(snd_fm,fst_fm),3,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_fun_apply_fm union_abs1 arity_forces[of "\<cdot>0`1 is 2\<cdot> "]
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 6" "?g_fm \<in> formula" "arity(?g_fm) \<le> 7"
       "?h_fm \<in> formula" "arity(?h_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function3 assms sats_check_fm check_abs
         fst_abs snd_abs
       unfolding hcomp_fm_def
       by simp
   qed
   moreover
-  have 1:"separation(##M, \<lambda>z. M, [snd(z), P, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
+  have 1:"separation(##M, \<lambda>z. M, [snd(z), \<bbbP>, leq, \<one>, f_dot, \<tau>, fst(z)\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))"
     if "\<tau>\<in>M" for \<tau>
   proof -
     let ?f_fm="snd_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),fst_fm,2,0)"
     note assms
     moreover
     have "arity(forces(\<cdot>0`1 is 2\<cdot> )) \<le> 7"
       using arity_forces[of "\<cdot>0`1 is 2\<cdot> "] arity_fun_apply_fm union_abs1
       by simp
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function that fst_abs snd_abs sats_check_fm check_abs
       unfolding hcomp_fm_def
       by simp
   qed
   moreover note assms
   ultimately
   show ?thesis
     using lam_replacement_imp_lam_closed lam_replacement_Collect' transitivity[of _ A]
       lam_replacement_constant lam_replacement_identity lam_replacement_snd
       lam_replacement_product separation_conj separation_in separation_bex separation_iff'
     by simp
 qed
 
 \<comment> \<open>Kunen IV.3.5\<close>
 lemma ccc_fun_approximation_lemma:
   notes le_trans[trans]
-  assumes "ccc\<^bsup>M\<^esup>(P,leq)" "A\<in>M" "B\<in>M" "f\<in>M[G]" "f : A \<rightarrow> B"
+  assumes "ccc\<^bsup>M\<^esup>(\<bbbP>,leq)" "A\<in>M" "B\<in>M" "f\<in>M[G]" "f : A \<rightarrow> B"
   shows
     "\<exists>F\<in>M. F : A \<rightarrow> Pow\<^bsup>M\<^esup>(B) \<and> (\<forall>a\<in>A. f`a \<in> F`a \<and> |F`a|\<^bsup>M\<^esup> \<le> \<omega>)"
 proof -
   from \<open>f\<in>M[G]\<close>
   obtain f_dot where "f = val(G,f_dot)" "f_dot\<in>M" using GenExtD by force
   with assms
   obtain p where "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]" "p\<in>G" "p\<in>M"
     using G_subset_M truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, A\<^sup>v, B\<^sup>v]"]
     by (auto simp add:ord_simp_union arity_typed_function_fm
         \<comment> \<open>NOTE: type-checking is not performed here by the Simplifier\<close>
         typed_function_type)
-  define F where "F\<equiv>\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
+  define F where "F\<equiv>\<lambda>a\<in>A. {b\<in>B. \<exists>q\<in>\<bbbP>. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
   from assms \<open>f_dot\<in>_\<close> \<open>p\<in>M\<close>
   have "F \<in> M"
     unfolding F_def using ccc_fun_closed_lemma by simp
   moreover from calculation
   have "f`a \<in> F`a" if "a \<in> A" for a
   proof -
     note \<open>f: A \<rightarrow> B\<close> \<open>a \<in> A\<close>
     moreover from this
     have "f ` a \<in> B" by simp
     moreover
     note \<open>f\<in>M[G]\<close> \<open>A\<in>M\<close>
     moreover from calculation
     have "M[G], [f, a, f`a] \<Turnstile> \<cdot>0`1 is 2\<cdot>"
       by (auto dest:transitivity)
     moreover
     note \<open>B\<in>M\<close> \<open>f = val(G,f_dot)\<close>
     moreover from calculation
     have "a\<in>M" "val(G, f_dot)`a\<in>M"
       by (auto dest:transitivity)
     moreover
     note \<open>f_dot\<in>M\<close> \<open>p\<in>G\<close>
     ultimately
     obtain q where "q \<preceq> p" "q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, (f`a)\<^sup>v]" "q\<in>G"
       using forces_below_filter[of "\<cdot>0`1 is 2\<cdot>" "[f_dot, a\<^sup>v, (f`a)\<^sup>v]" p]
       by (auto simp add: ord_simp_union arity_fun_apply_fm
           fun_apply_type)
     with \<open>f`a \<in> B\<close>
-    have "f`a \<in> {b\<in>B . \<exists>q\<in>P. q \<preceq> p \<and> q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}"
+    have "f`a \<in> {b\<in>B . \<exists>q\<in>\<bbbP>. q \<preceq> p \<and> q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}"
       by blast
     with \<open>a\<in>A\<close>
     show ?thesis unfolding F_def by simp
   qed
   moreover
   have "|F`a|\<^bsup>M\<^esup> \<le> \<omega> \<and> F`a\<in>M" if "a \<in> A" for a
   proof -
-    let ?Q="\<lambda>b. {q\<in>P. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
+    let ?Q="\<lambda>b. {q\<in>\<bbbP>. q \<preceq> p \<and> (q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v])}"
     from \<open>F \<in> M\<close> \<open>a\<in>A\<close> \<open>A\<in>M\<close>
     have "F`a \<in> M" "a\<in>M"
       using transitivity[OF _ \<open>A\<in>M\<close>] by simp_all
     moreover
     have 2:"\<And>x. x\<in>F`a \<Longrightarrow> x\<in>M"
       using transitivity[OF _ \<open>F`a\<in>M\<close>] by simp
     moreover
     have 3:"\<And>x. x\<in>F`a \<Longrightarrow> (##M)(?Q(x))"
       using ccc_fun_closed_lemma_aux[OF \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close> 2] transitivity[of _ "F`a"]
       by simp
     moreover
-    have 4:"lam_replacement(##M,\<lambda>b. {q \<in> P . q \<preceq> p \<and> (M, [q, P, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
+    have 4:"lam_replacement(##M,\<lambda>b. {q \<in> \<bbbP> . q \<preceq> p \<and> (M, [q, \<bbbP>, leq, \<one>, f_dot, a\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> ))})"
       using ccc_fun_closed_lemma_aux2[OF _ \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
         lam_replacement_iff_lam_closed[THEN iffD2]
         ccc_fun_closed_lemma_aux[OF  \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
       by simp
     ultimately
     interpret M_Pi_assumptions_choice "##M" "F`a" ?Q
       using Pi_replacement1[OF _ 3] lam_replacement_Sigfun[OF 4]
         lam_replacement_imp_strong_replacement
         ccc_fun_closed_lemma_aux[OF \<open>f_dot\<in>M\<close> \<open>p\<in>M\<close> \<open>a\<in>M\<close>]
         lam_replacement_hcomp2[OF lam_replacement_constant 4 _ _
           lam_replacement_minimum,unfolded lam_replacement_def]
       by unfold_locales simp_all
     from \<open>F`a \<in> M\<close>
-    interpret M_Pi_assumptions2 "##M" "F`a" ?Q "\<lambda>_ . P"
+    interpret M_Pi_assumptions2 "##M" "F`a" ?Q "\<lambda>_ . \<bbbP>"
       using lam_replacement_imp_strong_replacement[OF
           lam_replacement_Sigfun[OF lam_replacement_constant]]
         Pi_replacement1 transitivity[of _ "F`a"]
       by unfold_locales simp_all
     from \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]\<close> \<open>a\<in>A\<close>
     have "\<exists>y. y \<in> ?Q(b)" if "b \<in> F`a" for b
       using that unfolding F_def by auto
     then
     obtain q where "q \<in> Pi\<^bsup>M\<^esup>(F`a,?Q)" "q\<in>M" using AC_Pi_rel by auto
     moreover
     note \<open>F`a \<in> M\<close>
     moreover from calculation
-    have "q : F`a \<rightarrow>\<^bsup>M\<^esup> P"
+    have "q : F`a \<rightarrow>\<^bsup>M\<^esup> \<bbbP>"
       using Pi_rel_weaken_type def_function_space_rel by auto
     moreover from calculation
-    have "q : F`a \<rightarrow> range(q)" "q : F`a \<rightarrow> P" "q : F`a \<rightarrow>\<^bsup>M\<^esup> range(q)"
+    have "q : F`a \<rightarrow> range(q)" "q : F`a \<rightarrow> \<bbbP>" "q : F`a \<rightarrow>\<^bsup>M\<^esup> range(q)"
       using mem_function_space_rel_abs range_of_fun by simp_all
     moreover
     have "q`b \<bottom> q`c" if "b \<in> F`a" "c \<in> F`a" "b \<noteq> c"
       \<comment> \<open>For the next step, if the premise \<^term>\<open>b \<noteq> c\<close> is first,
         the proof breaks down badly\<close>
       for b c
     proof -
       from \<open>b \<in> F`a\<close> \<open>c \<in> F`a\<close> \<open>q \<in> Pi\<^bsup>M\<^esup>(F`a,?Q)\<close> \<open>q\<in>M\<close>
       have "q`b \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]"
         "q`c \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, c\<^sup>v]"
         using mem_Pi_rel_abs[of q] apply_type[of _ _  ?Q]
         by simp_all
-      with \<open>b \<noteq> c\<close> \<open>q : F`a \<rightarrow> P\<close> \<open>a\<in>A\<close> \<open>b\<in>_\<close> \<open>c\<in>_\<close>
+      with \<open>b \<noteq> c\<close> \<open>q : F`a \<rightarrow> \<bbbP>\<close> \<open>a\<in>A\<close> \<open>b\<in>_\<close> \<open>c\<in>_\<close>
         \<open>A\<in>M\<close> \<open>f_dot\<in>M\<close> \<open>F`a\<in>M\<close>
       show ?thesis
         using forces_neq_apply_imp_incompatible
           transitivity[of _ A] transitivity[of _ "F`a"]
         by auto
     qed
     moreover from calculation
-    have "antichain(P,leq,range(q))"
-      using Pi_range_eq[of _  _ "\<lambda>_ . P"]
+    have "antichain(\<bbbP>,leq,range(q))"
+      using Pi_range_eq[of _  _ "\<lambda>_ . \<bbbP>"]
       unfolding antichain_def compat_in_def by auto
     moreover from this and \<open>q\<in>M\<close>
-    have "antichain\<^bsup>M\<^esup>(P,leq,range(q))"
+    have "antichain\<^bsup>M\<^esup>(\<bbbP>,leq,range(q))"
       by (simp add:absolut del:P_in_M)
     moreover from calculation
     have "q`b \<noteq> q`c" if "b \<noteq> c" "b \<in> F`a" "c \<in> F`a" for b c
       using that Incompatible_imp_not_eq apply_type
         mem_function_space_rel_abs by simp
     ultimately
     have "q \<in> inj\<^bsup>M\<^esup>(F`a,range(q))"
       using def_inj_rel by auto
     with \<open>F`a \<in> M\<close> \<open>q\<in>M\<close>
     have "|F`a|\<^bsup>M\<^esup> \<le> |range(q)|\<^bsup>M\<^esup>"
       using def_lepoll_rel
       by (rule_tac lepoll_rel_imp_cardinal_rel_le) auto
-    also from \<open>antichain\<^bsup>M\<^esup>(P,leq,range(q))\<close> \<open>ccc\<^bsup>M\<^esup>(P,leq)\<close> \<open>q\<in>M\<close>
+    also from \<open>antichain\<^bsup>M\<^esup>(\<bbbP>,leq,range(q))\<close> \<open>ccc\<^bsup>M\<^esup>(\<bbbP>,leq)\<close> \<open>q\<in>M\<close>
     have "|range(q)|\<^bsup>M\<^esup> \<le> \<omega>"
       using def_ccc_rel by simp
     finally
     show ?thesis using \<open>F`a\<in>M\<close> by auto
   qed
   moreover from this
   have "F`a\<in>M" if "a\<in>A" for a
     using that by simp
   moreover from this \<open>B\<in>M\<close>
   have "F : A \<rightarrow> Pow\<^bsup>M\<^esup>(B)"
     using Pow_rel_char
     unfolding F_def by (rule_tac lam_type) auto
   ultimately
   show ?thesis by auto
 qed
 
 end \<comment> \<open>G\_generic1\_lemmas bundle\<close>
 
 end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Choice_Axiom.thy b/thys/Independence_CH/Choice_Axiom.thy
--- a/thys/Independence_CH/Choice_Axiom.thy
+++ b/thys/Independence_CH/Choice_Axiom.thy
@@ -1,322 +1,322 @@
 section\<open>The Axiom of Choice in $M[G]$\<close>
 
 theory Choice_Axiom
   imports
     Powerset_Axiom
     Extensionality_Axiom
     Foundation_Axiom
     Replacement_Axiom
     Infinity_Axiom
 begin
 
 definition
   upair_name :: "i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> i" where
   "upair_name(\<tau>,\<rho>,on) \<equiv> Upair(\<langle>\<tau>,on\<rangle>,\<langle>\<rho>,on\<rangle>)"
 
 definition
   opair_name :: "i \<Rightarrow> i \<Rightarrow> i \<Rightarrow> i" where
   "opair_name(\<tau>,\<rho>,on) \<equiv> upair_name(upair_name(\<tau>,\<tau>,on),upair_name(\<tau>,\<rho>,on),on)"
 
 definition
   induced_surj :: "i\<Rightarrow>i\<Rightarrow>i\<Rightarrow>i" where
   "induced_surj(f,a,e) \<equiv> f-``(range(f)-a)\<times>{e} \<union> restrict(f,f-``a)"
 
 lemma domain_induced_surj: "domain(induced_surj(f,a,e)) = domain(f)"
   unfolding induced_surj_def using domain_restrict domain_of_prod by auto
 
 lemma range_restrict_vimage:
   assumes "function(f)"
   shows "range(restrict(f,f-``a)) \<subseteq> a"
 proof
   from assms
   have "function(restrict(f,f-``a))"
     using function_restrictI by simp
   fix y
   assume "y \<in> range(restrict(f,f-``a))"
   then
   obtain x where "\<langle>x,y\<rangle> \<in> restrict(f,f-``a)"  "x \<in> f-``a" "x\<in>domain(f)"
     using domain_restrict domainI[of _ _ "restrict(f,f-``a)"] by auto
   moreover
   note \<open>function(restrict(f,f-``a))\<close>
   ultimately
   have "y = restrict(f,f-``a)`x"
     using function_apply_equality by blast
   also from \<open>x \<in> f-``a\<close>
   have "restrict(f,f-``a)`x = f`x"
     by simp
   finally
   have "y = f`x" .
   moreover from assms \<open>x\<in>domain(f)\<close>
   have "\<langle>x,f`x\<rangle> \<in> f"
     using function_apply_Pair by auto
   moreover
   note assms \<open>x \<in> f-``a\<close>
   ultimately
   show "y\<in>a"
     using function_image_vimage[of f a] by auto
 qed
 
 lemma induced_surj_type:
   assumes "function(f)" (* "relation(f)" (* a function can contain non-pairs *) *)
   shows
     "induced_surj(f,a,e): domain(f) \<rightarrow> {e} \<union> a"
     and
     "x \<in> f-``a \<Longrightarrow> induced_surj(f,a,e)`x = f`x"
 proof -
   let ?f1="f-``(range(f)-a) \<times> {e}" and ?f2="restrict(f, f-``a)"
   have "domain(?f2) = domain(f) \<inter> f-``a"
     using domain_restrict by simp
   moreover from assms
   have "domain(?f1) = f-``(range(f))-f-``a"
     using domain_of_prod function_vimage_Diff by simp
   ultimately
   have "domain(?f1) \<inter> domain(?f2) = 0"
     by auto
   moreover
   have "function(?f1)" "relation(?f1)" "range(?f1) \<subseteq> {e}"
     unfolding function_def relation_def range_def by auto
   moreover from this and assms
   have "?f1: domain(?f1) \<rightarrow> range(?f1)"
     using function_imp_Pi by simp
   moreover from assms
   have "?f2: domain(?f2) \<rightarrow> range(?f2)"
     using function_imp_Pi[of "restrict(f, f -`` a)"] function_restrictI by simp
   moreover from assms
   have "range(?f2) \<subseteq> a"
     using range_restrict_vimage by simp
   ultimately
   have "induced_surj(f,a,e): domain(?f1) \<union> domain(?f2) \<rightarrow> {e} \<union> a"
     unfolding induced_surj_def using fun_is_function fun_disjoint_Un fun_weaken_type by simp
   moreover
   have "domain(?f1) \<union> domain(?f2) = domain(f)"
     using domain_restrict domain_of_prod by auto
   ultimately
   show "induced_surj(f,a,e): domain(f) \<rightarrow> {e} \<union> a"
     by simp
   assume "x \<in> f-``a"
   then
   have "?f2`x = f`x"
     using restrict by simp
   moreover from \<open>x \<in> f-``a\<close> \<open>domain(?f1) = _\<close>
   have "x \<notin> domain(?f1)"
     by simp
   ultimately
   show "induced_surj(f,a,e)`x = f`x"
     unfolding induced_surj_def using fun_disjoint_apply2[of x ?f1 ?f2] by simp
 qed
 
 lemma induced_surj_is_surj :
   assumes
     "e\<in>a" "function(f)" "domain(f) = \<alpha>" "\<And>y. y \<in> a \<Longrightarrow> \<exists>x\<in>\<alpha>. f ` x = y"
   shows "induced_surj(f,a,e) \<in> surj(\<alpha>,a)"
   unfolding surj_def
 proof (intro CollectI ballI)
   from assms
   show "induced_surj(f,a,e): \<alpha> \<rightarrow> a"
     using induced_surj_type[of f a e] cons_eq cons_absorb by simp
   fix y
   assume "y \<in> a"
   with assms
   have "\<exists>x\<in>\<alpha>. f ` x = y"
     by simp
   then
   obtain x where "x\<in>\<alpha>" "f ` x = y" by auto
   with \<open>y\<in>a\<close> assms
   have "x\<in>f-``a"
     using vimage_iff function_apply_Pair[of f x] by auto
   with \<open>f ` x = y\<close> assms
   have "induced_surj(f, a, e) ` x = y"
     using induced_surj_type by simp
   with \<open>x\<in>\<alpha>\<close> show
     "\<exists>x\<in>\<alpha>. induced_surj(f, a, e) ` x = y" by auto
 qed
 
 lemma (in M_ZF1_trans) upair_name_closed :
   "\<lbrakk> x\<in>M; y\<in>M ; o\<in>M\<rbrakk> \<Longrightarrow> upair_name(x,y,o)\<in>M"
   unfolding upair_name_def
   using upair_in_M_iff pair_in_M_iff Upair_eq_cons
   by simp
 
 context G_generic1
 begin
 
 lemma val_upair_name : "val(G,upair_name(\<tau>,\<rho>,\<one>)) = {val(G,\<tau>),val(G,\<rho>)}"
   unfolding upair_name_def
   using val_Upair Upair_eq_cons generic one_in_G
   by simp
 
 lemma val_opair_name : "val(G,opair_name(\<tau>,\<rho>,\<one>)) = \<langle>val(G,\<tau>),val(G,\<rho>)\<rangle>"
   unfolding opair_name_def Pair_def
   using val_upair_name by simp
 
 lemma val_RepFun_one: "val(G,{\<langle>f(x),\<one>\<rangle> . x\<in>a}) = {val(G,f(x)) . x\<in>a}"
 proof -
   let ?A = "{f(x) . x \<in> a}"
   let ?Q = "\<lambda>\<langle>x,p\<rangle> . p = \<one>"
-  have "\<one> \<in> P\<inter>G" using generic one_in_G one_in_P by simp
-  have "{\<langle>f(x),\<one>\<rangle> . x \<in> a} = {t \<in> ?A \<times> P . ?Q(t)}"
+  have "\<one> \<in> \<bbbP>\<inter>G" using generic one_in_G one_in_P by simp
+  have "{\<langle>f(x),\<one>\<rangle> . x \<in> a} = {t \<in> ?A \<times> \<bbbP> . ?Q(t)}"
     using one_in_P by force
   then
-  have "val(G,{\<langle>f(x),\<one>\<rangle>  . x \<in> a}) = val(G,{t \<in> ?A \<times> P . ?Q(t)})"
+  have "val(G,{\<langle>f(x),\<one>\<rangle>  . x \<in> a}) = val(G,{t \<in> ?A \<times> \<bbbP> . ?Q(t)})"
     by simp
   also
-  have "... = {z . t \<in> ?A , (\<exists>p\<in>P\<inter>G . ?Q(\<langle>t,p\<rangle>)) \<and> z= val(G,t)}"
+  have "... = {z . t \<in> ?A , (\<exists>p\<in>\<bbbP>\<inter>G . ?Q(\<langle>t,p\<rangle>)) \<and> z= val(G,t)}"
     using val_of_name_alt by simp
-  also from \<open>\<one>\<in>P\<inter>G\<close>
+  also from \<open>\<one>\<in>\<bbbP>\<inter>G\<close>
   have "... = {val(G,t) . t \<in> ?A }"
     by force
   also
   have "... = {val(G,f(x)) . x \<in> a}"
     by auto
   finally
   show ?thesis
     by simp
 qed
 
 end\<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 subsection\<open>$M[G]$ is a transitive model of ZF\<close>
 
 sublocale G_generic1 \<subseteq> ext:M_Z_trans "M[G]"
   using Transset_MG generic pairing_in_MG Union_MG
     extensionality_in_MG power_in_MG foundation_in_MG
     replacement_assm_MG separation_in_MG infinity_in_MG
     replacement_ax1
   by unfold_locales
 
 lemma (in M_replacement) upair_name_lam_replacement :
   "M(z) \<Longrightarrow> lam_replacement(M,\<lambda>x . upair_name(fst(x),snd(x),z))"
   using lam_replacement_Upair[THEN [5] lam_replacement_hcomp2]
     lam_replacement_product
     lam_replacement_fst lam_replacement_snd lam_replacement_constant
   unfolding upair_name_def
   by simp
 
 lemma (in forcing_data1) repl_opname_check :
   assumes "A\<in>M" "f\<in>M"
   shows "{opair_name(check(x),f`x,\<one>). x\<in>A}\<in>M"
     using assms lam_replacement_constant check_lam_replacement lam_replacement_identity
       upair_name_lam_replacement[THEN [5] lam_replacement_hcomp2]
       lam_replacement_apply2[THEN [5] lam_replacement_hcomp2]
       lam_replacement_imp_strong_replacement_aux
       transitivity RepFun_closed upair_name_closed apply_closed
     unfolding opair_name_def
     by simp
 
 theorem (in G_generic1) choice_in_MG:
   assumes "choice_ax(##M)"
   shows "choice_ax(##M[G])"
 proof -
   {
     fix a
     assume "a\<in>M[G]"
     then
     obtain \<tau> where "\<tau>\<in>M" "val(G,\<tau>) = a"
       using GenExt_def by auto
     with \<open>\<tau>\<in>M\<close>
     have "domain(\<tau>)\<in>M"
       using domain_closed by simp
     then
     obtain s \<alpha> where "s\<in>surj(\<alpha>,domain(\<tau>))" "Ord(\<alpha>)" "s\<in>M" "\<alpha>\<in>M"
       using assms choice_ax_abs
       by auto
     then
     have "\<alpha>\<in>M[G]"
       using M_subset_MG generic one_in_G subsetD
       by blast
-    let ?A="domain(\<tau>)\<times>P"
+    let ?A="domain(\<tau>)\<times>\<bbbP>"
     let ?g = "{opair_name(check(\<beta>),s`\<beta>,\<one>). \<beta>\<in>\<alpha>}"
     have "?g \<in> M"
       using \<open>s\<in>M\<close> \<open>\<alpha>\<in>M\<close> repl_opname_check
       by simp
     let ?f_dot="{\<langle>opair_name(check(\<beta>),s`\<beta>,\<one>),\<one>\<rangle>. \<beta>\<in>\<alpha>}"
     have "?f_dot = ?g \<times> {\<one>}" by blast
     define f where
       "f \<equiv> val(G,?f_dot)"
     from \<open>?g\<in>M\<close> \<open>?f_dot = ?g\<times>{\<one>}\<close>
     have "?f_dot\<in>M"
       using cartprod_closed singleton_closed
       by simp
     then
     have "f \<in> M[G]"
       unfolding f_def
       by (blast intro:GenExtI)
     have "f = {val(G,opair_name(check(\<beta>),s`\<beta>,\<one>)) . \<beta>\<in>\<alpha>}"
       unfolding f_def
       using val_RepFun_one
       by simp
     also
     have "... = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}"
       using val_opair_name val_check generic one_in_G one_in_P
       by simp
     finally
     have "f = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}" .
     then
     have 1: "domain(f) = \<alpha>" "function(f)"
       unfolding function_def by auto
     have 2: "y \<in> a \<Longrightarrow> \<exists>x\<in>\<alpha>. f ` x = y" for y
     proof -
       fix y
       assume
         "y \<in> a"
       with \<open>val(G,\<tau>) = a\<close>
       obtain \<sigma> where  "\<sigma>\<in>domain(\<tau>)" "val(G,\<sigma>) = y"
         using elem_of_val[of y _ \<tau>]
         by blast
       with \<open>s\<in>surj(\<alpha>,domain(\<tau>))\<close>
       obtain \<beta> where "\<beta>\<in>\<alpha>" "s`\<beta> = \<sigma>"
         unfolding surj_def
         by auto
       with \<open>val(G,\<sigma>) = y\<close>
       have "val(G,s`\<beta>) = y"
         by simp
       with \<open>f = {\<langle>\<beta>,val(G,s`\<beta>)\<rangle> . \<beta>\<in>\<alpha>}\<close> \<open>\<beta>\<in>\<alpha>\<close>
       have "\<langle>\<beta>,y\<rangle>\<in>f"
         by auto
       with \<open>function(f)\<close>
       have "f`\<beta> = y"
         using function_apply_equality by simp
       with \<open>\<beta>\<in>\<alpha>\<close> show
         "\<exists>\<beta>\<in>\<alpha>. f ` \<beta> = y"
         by auto
     qed
     then
     have "\<exists>\<alpha>\<in>(M[G]). \<exists>f'\<in>(M[G]). Ord(\<alpha>) \<and> f' \<in> surj(\<alpha>,a)"
     proof (cases "a=0")
       case True
       then
       show ?thesis
         unfolding surj_def
         using zero_in_MG
         by auto
     next
       case False
       with \<open>a\<in>M[G]\<close>
       obtain e where "e\<in>a" "e\<in>M[G]"
         using transitivity_MG
         by blast
       with 1 and 2
       have "induced_surj(f,a,e) \<in> surj(\<alpha>,a)"
         using induced_surj_is_surj by simp
       moreover from \<open>f\<in>M[G]\<close> \<open>a\<in>M[G]\<close> \<open>e\<in>M[G]\<close>
       have "induced_surj(f,a,e) \<in> M[G]"
         unfolding induced_surj_def
         by (simp flip: setclass_iff)
       moreover
       note \<open>\<alpha>\<in>M[G]\<close> \<open>Ord(\<alpha>)\<close>
       ultimately
       show ?thesis
         by auto
     qed
   }
   then
   show ?thesis
     using ext.choice_ax_abs
     by simp
 qed
 
 sublocale G_generic1_AC \<subseteq> ext:M_ZC_basic "M[G]"
   using choice_ax choice_in_MG
   by unfold_locales
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Definitions_Main.thy b/thys/Independence_CH/Definitions_Main.thy
--- a/thys/Independence_CH/Definitions_Main.thy
+++ b/thys/Independence_CH/Definitions_Main.thy
@@ -1,641 +1,640 @@
 section\<open>Main definitions of the development\label{sec:main-definitions}\<close>
 
 theory Definitions_Main
   imports
     Absolute_Versions
 begin
 
 text\<open>This theory gathers the main definitions of the
 \<^session>\<open>Transitive_Models\<close> session and the present one.
 
 It might be considered as the bare minimum reading requisite to
 trust that our development indeed formalizes the theory of
 forcing. This should be mathematically clear since this is the
 only known method for obtaining proper extensions of ctms while
 preserving the ordinals.
 
 The main theorem of this session and all of its relevant definitions
 appear in Section~\ref{sec:def-main-forcing}. The reader trusting
 all the libraries on which our development is based, might jump
 directly to Section~\ref{sec:relative-arith}, which treats relative
 cardinal arithmetic as implemented in
 \<^session>\<open>Transitive_Models\<close>. But in case one wants to dive deeper, the
 following sections treat some basic concepts of the ZF logic
 (Section~\ref{sec:def-main-ZF}) and in the
 ZF-Constructible library (Section~\ref{sec:def-main-relative})
 on which our definitions are built.
 \<close>
 
 declare [[show_question_marks=false]]
 
 subsection\<open>ZF\label{sec:def-main-ZF}\<close>
 
 text\<open>For the basic logic ZF we restrict ourselves to just a few
 concepts.\<close>
 
 thm bij_def[unfolded inj_def surj_def]
 text\<open>@{thm [display] bij_def[unfolded inj_def surj_def]}\<close>
 (*
 bij(A, B) \<equiv>
   {f \<in> A \<rightarrow> B . \<forall>w\<in>A. \<forall>x\<in>A. f ` w = f ` x \<longrightarrow> w = x} \<inter>
   {f \<in> A \<rightarrow> B . \<forall>y\<in>B. \<exists>x\<in>A. f ` x = y}
 *)
 
 thm eqpoll_def
 text\<open>@{thm [display] eqpoll_def}\<close>
 (*
   A \<approx> B \<equiv> \<exists>f. f \<in> bij(A, B)
 *)
 
 thm Transset_def
 text\<open>@{thm [display] Transset_def}\<close>
 (*
   Transset(i) \<equiv> \<forall>x\<in>i. x \<subseteq> i
 *)
 
 thm Ord_def
 text\<open>@{thm [display] Ord_def}\<close>
 (*
   Ord(i) \<equiv> Transset(i) \<and> (\<forall>x\<in>i. Transset(x))
 *)
 
 thm lt_def le_iff
 text\<open>@{thm [display] lt_def le_iff}\<close>
 (*
   i < j \<equiv> i \<in> j \<and> Ord(j)
   i \<le> j \<longleftrightarrow> i < j \<or> i = j \<and> Ord(j)
 *)
 
 text\<open>With the concepts of empty set and successor in place,\<close>
 lemma empty_def': "\<forall>x. x \<notin> 0" by simp
 lemma succ_def': "succ(i) = i \<union> {i}" by blast
 
 text\<open>we can define the set of natural numbers \<^term>\<open>\<omega>\<close>. In the
 sources, it is  defined as a fixpoint, but here we just write
 its characterization as the first limit ordinal.\<close>
 thm Limit_nat[unfolded Limit_def] nat_le_Limit[unfolded Limit_def]
 text\<open>@{thm [display] Limit_nat[unfolded Limit_def]
  nat_le_Limit[unfolded Limit_def]}\<close>
 (*
   Ord(\<omega>) \<and> 0 < \<omega> \<and> (\<forall>y. y < \<omega> \<longrightarrow> succ(y) < \<omega>)
   Ord(i) \<and> 0 < i \<and> (\<forall>y. y < i \<longrightarrow> succ(y) < i) \<Longrightarrow> \<omega> \<le> i
 *)
 
 text\<open>Then, addition and predecessor on \<^term>\<open>\<omega>\<close> are inductively
 characterized as follows:\<close>
 thm add_0_right add_succ_right pred_0 pred_succ_eq
 text\<open>@{thm [display] add_succ_right add_0_right pred_0 pred_succ_eq}\<close>
 (*
   m \<in> \<omega> \<Longrightarrow> m +\<^sub>\<omega> 0 = m
   m +\<^sub>\<omega> succ(n) = succ(m +\<^sub>\<omega> n)
 
   pred(0) = 0
   pred(succ(y)) = y
 *)
 
 text\<open>Lists on a set \<^term>\<open>A\<close> can be characterized by being
 recursively generated from the empty list \<^term>\<open>[]\<close> and the
 operation \<^term>\<open>Cons\<close> that adds a new element to the left end;
 the induction theorem for them shows that the characterization is
 “complete”.\<close>
 
 thm Nil Cons list.induct
 text\<open>@{thm [display] Nil Cons list.induct }\<close>
 (*
   [] \<in> list(A)
   a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> Cons(a, l) \<in> list(A)
   x \<in> list(A) \<Longrightarrow>
   P([]) \<Longrightarrow> (\<And>a l. a \<in> A \<Longrightarrow> l \<in> list(A) \<Longrightarrow> P(l) \<Longrightarrow> P(Cons(a, l))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Length, concatenation, and \<^term>\<open>n\<close>th element of lists are
 recursively characterized as follows.\<close>
 thm length.simps app.simps nth_0 nth_Cons
 text\<open>@{thm [display] length.simps app.simps nth_0 nth_Cons}\<close>
 (*
   length([]) = 0
   length(Cons(a, l)) = succ(length(l))
 
   [] @ ys = ys
   Cons(a, l) @ ys = Cons(a, l @ ys)
 
   nth(0, Cons(a, l)) = a
   n \<in> \<omega> \<Longrightarrow> nth(succ(n), Cons(a, l)) = nth(n, l)
 *)
 text\<open>We have the usual Haskell-like notation for iterated applications
 of \<^term>\<open>Cons\<close>:\<close>
 lemma Cons_app: "[a,b,c] = Cons(a,Cons(b,Cons(c,[])))" ..
 
 text\<open>Relative quantifiers restrict the range of the bound variable to a
 class \<^term>\<open>M\<close> of type \<^typ>\<open>i\<Rightarrow>o\<close>; that is, a truth-valued function with
 set arguments.\<close>
 lemma "\<forall>x[M]. P(x) \<equiv> \<forall>x. M(x) \<longrightarrow> P(x)"
       "\<exists>x[M]. P(x) \<equiv> \<exists>x. M(x) \<and> P(x)"
   unfolding rall_def rex_def .
 
 text\<open>Finally, a set can be viewed (“cast”) as a class using the
 following function of type \<^typ>\<open>i\<Rightarrow>(i\<Rightarrow>o)\<close>.\<close>
 thm setclass_iff
 text\<open>@{thm [display] setclass_iff}\<close>
 (*
   (##A)(x) \<longleftrightarrow> x \<in> A
 *)
 
 subsection\<open>Relative concepts\label{sec:def-main-relative}\<close>
 text\<open>A list of relative concepts (mostly from the ZF-Constructible
     library) follows next.\<close>
 
 thm big_union_def
 text\<open>@{thm [display] big_union_def}\<close>
 (*
   big_union(M, A, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> A \<and> x \<in> y)
 *)
 
 thm upair_def
 text\<open>@{thm [display] upair_def}\<close>
 (*
   upair(M, a, b, z) \<equiv> a \<in> z \<and> b \<in> z \<and> (\<forall>x[M]. x \<in> z \<longrightarrow> x = a \<or> x = b)
 *)
 
 thm pair_def
 text\<open>@{thm [display] pair_def}\<close>
 (*
   pair(M, a, b, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and>
                         (\<exists>y[M]. upair(M, a, b, y) \<and> upair(M, x, y, z))
 *)
 
 thm successor_def[unfolded is_cons_def union_def]
 text\<open>@{thm [display] successor_def[unfolded is_cons_def union_def]}\<close>
 (*
   successor(M, a, z) \<equiv> \<exists>x[M]. upair(M, a, a, x) \<and> (\<forall>xa[M]. xa \<in> z \<longleftrightarrow> xa \<in> x \<or> xa \<in> a)
 *)
 
 thm empty_def
 text\<open>@{thm [display] empty_def}\<close>
 (*
   empty(M, z) \<equiv> \<forall>x[M]. x \<notin> z
 *)
 
 thm transitive_set_def[unfolded subset_def]
 text\<open>@{thm [display] transitive_set_def[unfolded subset_def]}\<close>
 (*
   transitive_set(M, a) \<equiv> \<forall>x[M]. x \<in> a \<longrightarrow> (\<forall>xa[M]. xa \<in> x \<longrightarrow> xa \<in> a)
 *)
 
 
 thm ordinal_def
 text\<open>@{thm [display] ordinal_def}\<close>
 (*
   ordinal(M, a) \<equiv> transitive_set(M, a) \<and> (\<forall>x[M]. x \<in> a \<longrightarrow>
                                               transitive_set(M, x))
 *)
 
 thm image_def
 text\<open>@{thm [display] image_def}\<close>
 (*
   image(M, r, A, z) \<equiv> \<forall>y[M]. y \<in> z \<longleftrightarrow>
                 (\<exists>w[M]. w \<in> r \<and> (\<exists>x[M]. x \<in> A \<and> pair(M, x, y, w)))
 *)
 
 thm fun_apply_def
 text\<open>@{thm [display] fun_apply_def}\<close>
 (*
   fun_apply(M, f, x, y) \<equiv> \<exists>xs[M]. \<exists>fxs[M]. upair(M, x, x, xs) \<and>
                        image(M, f, xs, fxs) \<and> big_union(M, fxs, y)
 *)
 
 thm is_function_def
 text\<open>@{thm [display] is_function_def}\<close>
 (*
   is_function(M, r) \<equiv> \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
        pair(M, x, y, p) \<longrightarrow> pair(M, x, y', p') \<longrightarrow> p \<in> r \<longrightarrow> p' \<in> r \<longrightarrow> y = y'
 *)
 
 thm is_relation_def
 text\<open>@{thm [display] is_relation_def}\<close>
 (*
   is_relation(M, r) \<equiv> \<forall>z[M]. z \<in> r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M, x, y, z))
 *)
 
 thm is_domain_def
 text\<open>@{thm [display] is_domain_def}\<close>
 (*
   is_domain(M, r, z) \<equiv> \<forall>x[M]. x \<in> z \<longleftrightarrow>
                         (\<exists>w[M]. w \<in> r \<and> (\<exists>y[M]. pair(M, x, y, w)))
 *)
 
 thm typed_function_def
 text\<open>@{thm [display] typed_function_def}\<close>
 (*
   typed_function(M, A, B, r) \<equiv> is_function(M, r) \<and> is_relation(M, r) \<and>
                                 is_domain(M, r, A) \<and>
             (\<forall>u[M]. u \<in> r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M, x, y, u) \<longrightarrow> y \<in> B))
 *)
 
 thm is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def
 text\<open>@{thm [display] is_function_space_def[unfolded is_funspace_def]
   function_space_rel_def surjection_def}\<close>
 (*
   is_function_space(M, A, B, fs) \<equiv>
   M(fs) \<and> (\<forall>f[M]. f \<in> fs \<longleftrightarrow> typed_function(M, A, B, f))
 
   A \<rightarrow>\<^bsup>M\<^esup> B \<equiv> THE d. is_function_space(M, A, B, d)
 
   surjection(M, A, B, f) \<equiv>
   typed_function(M, A, B, f) \<and>
   (\<forall>y[M]. y \<in> B \<longrightarrow> (\<exists>x[M]. x \<in> A \<and> is_apply(M, f, x, y)))
 *)
 
 
 text\<open>Relative version of the $\ZFC$ axioms\<close>
 thm extensionality_def
 text\<open>@{thm [display] extensionality_def}\<close>
 (*
   extensionality(M) \<equiv> \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x = y
 *)
 
 thm foundation_ax_def
 text\<open>@{thm [display] foundation_ax_def}\<close>
 (*
   foundation_ax(M) \<equiv> \<forall>x[M]. (\<exists>y[M]. y \<in> x) \<longrightarrow> (\<exists>y[M]. y \<in> x \<and> \<not> (\<exists>z[M]. z \<in> x \<and> z \<in> y))
 *)
 
 thm upair_ax_def
 text\<open>@{thm [display] upair_ax_def}\<close>
 (*
   upair_ax(M) \<equiv> \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M, x, y, z)
 *)
 
 thm Union_ax_def
 text\<open>@{thm [display] Union_ax_def}\<close>
 (*
   Union_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<exists>y[M]. y \<in> x \<and> xa \<in> y)
 *)
 
 thm power_ax_def[unfolded powerset_def subset_def]
 text\<open>@{thm [display] power_ax_def[unfolded powerset_def subset_def]}\<close>
 (*
   power_ax(M) \<equiv> \<forall>x[M]. \<exists>z[M]. \<forall>xa[M]. xa \<in> z \<longleftrightarrow> (\<forall>xb[M]. xb \<in> xa \<longrightarrow> xb \<in> x)
 *)
 
 thm infinity_ax_def
 text\<open>@{thm [display] infinity_ax_def}\<close>
 (*
   infinity_ax(M) \<equiv> \<exists>I[M]. (\<exists>z[M]. empty(M, z) \<and> z \<in> I) \<and> (\<forall>y[M]. y \<in> I \<longrightarrow>
                         (\<exists>sy[M]. successor(M, y, sy) \<and> sy \<in> I))
 *)
 
 thm choice_ax_def
 text\<open>@{thm [display] choice_ax_def}\<close>
 (*
   choice_ax(M) \<equiv> \<forall>x[M]. \<exists>a[M]. \<exists>f[M]. ordinal(M, a) \<and> surjection(M, a, x, f)
 *)
 
 thm separation_def
 text\<open>@{thm [display] separation_def}\<close>
 (*
   separation(M, P) \<equiv> \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z \<and> P(x)
 *)
 
 thm univalent_def
 text\<open>@{thm [display] univalent_def}\<close>
 (*
   univalent(M, A, P) \<equiv> \<forall>x[M]. x \<in> A \<longrightarrow>
                           (\<forall>y[M]. \<forall>z[M]. P(x, y) \<and> P(x, z) \<longrightarrow> y = z)
 *)
 
 thm strong_replacement_def
 text\<open>@{thm [display] strong_replacement_def}\<close>
 (*
   strong_replacement(M, P) \<equiv> \<forall>A[M]. univalent(M, A, P) \<longrightarrow>
        (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x \<in> A \<and> P(x, b)))
 *)
 
 text\<open>Internalized formulas\<close>
 
 text\<open>“Codes” for formulas (as sets) are constructed from natural
 numbers using \<^term>\<open>Member\<close>, \<^term>\<open>Equal\<close>, \<^term>\<open>Nand\<close>,
 and \<^term>\<open>Forall\<close>.\<close>
 
 thm Member Equal Nand Forall formula.induct
 text\<open>@{thm [display] Member Equal Nand Forall formula.induct}\<close>
 (*
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x \<in> y\<cdot> \<in> formula
   x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> \<cdot>x = y\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> q \<in> formula \<Longrightarrow> \<cdot>\<not>(p \<and> q)\<cdot> \<in> formula
   p \<in> formula \<Longrightarrow> (\<forall>p) \<in> formula
 
   x \<in> formula \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x \<in> y\<cdot>)) \<Longrightarrow>
   (\<And>x y. x \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> P(\<cdot>x = y\<cdot>)) \<Longrightarrow>
   (\<And>p q. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> q \<in> formula \<Longrightarrow> P(q) \<Longrightarrow> P(\<cdot>\<not>(p \<and> q)\<cdot>)) \<Longrightarrow>
   (\<And>p. p \<in> formula \<Longrightarrow> P(p) \<Longrightarrow> P((\<forall>p))) \<Longrightarrow> P(x)
 *)
 
 text\<open>Definitions for the other connectives and the internal existential
 quantifier are also provided. For instance, negation:\<close>
 thm Neg_def
 text\<open>@{thm [display] Neg_def}\<close>
 (*
   \<cdot>\<not>p\<cdot> \<equiv> \<cdot>\<not>(p \<and> p)\<cdot>
 *)
 
 thm arity.simps
 text\<open>@{thm [display] arity.simps}\<close>
 (*
   arity(\<cdot>x \<in> y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>x = y\<cdot>) = succ(x) \<union> succ(y)
   arity(\<cdot>\<not>(p \<and> q)\<cdot>) = arity(p) \<union> arity(q)
   arity((\<forall>p)) = pred(arity(p))
 *)
 
 text\<open>We have the satisfaction relation between $\in$-models and
     first order formulas (given a “environment” list representing
     the assignment of free variables),\<close>
 thm mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff
 text\<open>@{thm [display] mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff}\<close>
 (*
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x \<in> y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i \<in> j\<cdot>
   nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> env \<in> list(A) \<Longrightarrow> x = y \<longleftrightarrow> A, env \<Turnstile> \<cdot>i = j\<cdot>
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> \<cdot>\<not>(p \<and> q)\<cdot>) \<longleftrightarrow> \<not> ((A, env \<Turnstile> p) \<and> (A, env \<Turnstile> q))
   env \<in> list(A) \<Longrightarrow> (A, env \<Turnstile> (\<cdot>\<forall>p\<cdot>)) \<longleftrightarrow> (\<forall>x\<in>A. A, Cons(x, env) \<Turnstile> p)*)
 
 text\<open>as well as the satisfaction of an arbitrary set of sentences.\<close>
 thm satT_def
 text\<open>@{thm [display] satT_def}\<close>
 (*
   A \<Turnstile> \<Phi>  \<equiv>  \<forall>\<phi>\<in>\<Phi>. A, [] \<Turnstile> \<phi>
 *)
 
 text\<open>The internalized (viz. as elements of the set \<^term>\<open>formula\<close>)
     version of the axioms follow next.\<close>
 
 thm ZF_union_iff_sats ZF_power_iff_sats ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats
 text\<open>@{thm [display] ZF_union_iff_sats ZF_power_iff_sats
   ZF_pairing_iff_sats
   ZF_foundation_iff_sats ZF_extensionality_iff_sats
   ZF_infinity_iff_sats sats_ZF_separation_fm_iff
   sats_ZF_replacement_fm_iff ZF_choice_iff_sats}\<close>
 (*
   Union_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Union Ax\<cdot>
   power_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Powerset Ax\<cdot>
   upair_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Pairing\<cdot>
   foundation_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Foundation\<cdot>
   extensionality(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Extensionality\<cdot>
   infinity_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>Infinity\<cdot>
 
   \<phi> \<in> formula \<Longrightarrow>
   (M, [] \<Turnstile> \<cdot>Separation(\<phi>)\<cdot>) \<longleftrightarrow>
   (\<forall>env\<in>list(M).
       arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<longrightarrow> separation(##M, \<lambda>x. M, [x] @ env \<Turnstile> \<phi>))
 
   \<phi> \<in> formula \<Longrightarrow>
   (M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>) \<longleftrightarrow> (\<forall>env. replacement_assm(M, env, \<phi>))
 
   choice_ax(##A) \<longleftrightarrow> A, [] \<Turnstile> \<cdot>AC\<cdot>
 *)
 
 text\<open>Above, we use the following:\<close>
 
 thm replacement_assm_def
 text\<open>@{thm [display] replacement_assm_def}\<close>
 (*
 replacement_assm(M, env, \<phi>) \<equiv>
 \<phi> \<in> formula \<longrightarrow>
 env \<in> list(M) \<longrightarrow>
 arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env) \<longrightarrow>
 strong_replacement(##M, \<lambda>x y. M, [x, y] @ env \<Turnstile> \<phi>
 *)
 
 text\<open>Finally, the axiom sets are defined as follows.\<close>
 
 thm ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def ZFC_def
 text\<open>@{thm [display] ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def
   ZFC_def}\<close>
 (*
   ZF_fin \<equiv> {\<cdot>Extensionality\<cdot>, \<cdot>Foundation\<cdot>, \<cdot>Pairing\<cdot>, \<cdot>Union Ax\<cdot>, \<cdot>Infinity\<cdot>, \<cdot>Powerset Ax\<cdot>}
   ZF_schemes \<equiv> {\<cdot>Separation(p)\<cdot> . p \<in> formula} \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> formula}
   \<cdot>Z\<cdot> \<equiv> ZF_fin \<union> {\<cdot>Separation(p)\<cdot> . p \<in> formula}
   ZC \<equiv> \<cdot>Z\<cdot> \<union> {\<cdot>AC\<cdot>}
   ZF \<equiv> ZF_schemes \<union> ZF_fin
   ZFC \<equiv> ZF \<union> {\<cdot>AC\<cdot>}
 *)
 
 subsection\<open>Relativization of infinitary arithmetic\label{sec:relative-arith}\<close>
 
 text\<open>In order to state the defining property of the relative
     equipotence relation, we work under the assumptions of the
     locale \<^term>\<open>M_cardinals\<close>. They comprise a finite set
     of instances of Separation and Replacement to prove
     closure properties of the transitive class \<^term>\<open>M\<close>.\<close>
 
 lemma (in M_cardinals) eqpoll_def':
   assumes "M(A)" "M(B)" shows "A \<approx>\<^bsup>M\<^esup> B \<longleftrightarrow> (\<exists>f[M]. f \<in> bij(A,B))"
   using assms unfolding eqpoll_rel_def by auto
 
 text\<open>Below, $\mu$ denotes the minimum operator on the ordinals.\<close>
 lemma cardinalities_defs:
   fixes M::"i\<Rightarrow>o"
   shows
     "|A|\<^bsup>M\<^esup> \<equiv> \<mu> i. M(i) \<and> i \<approx>\<^bsup>M\<^esup> A"
     "Card\<^bsup>M\<^esup>(\<alpha>) \<equiv> \<alpha> = |\<alpha>|\<^bsup>M\<^esup>"
     "\<kappa>\<^bsup>\<up>\<nu>,M\<^esup> \<equiv> |\<nu> \<rightarrow>\<^bsup>M\<^esup> \<kappa>|\<^bsup>M\<^esup>"
     "(\<kappa>\<^sup>+)\<^bsup>M\<^esup> \<equiv> \<mu> x. M(x) \<and> Card\<^bsup>M\<^esup>(x) \<and> \<kappa> < x"
   unfolding cardinal_rel_def cexp_rel_def
     csucc_rel_def Card_rel_def .
 
 context M_aleph
 begin
 
 text\<open>Analogous to the previous Lemma @{thm [source] eqpoll_def'}, we are now under
     the assumptions of the locale \<^term>\<open>M_aleph\<close>. The axiom instances
     included are sufficient to state and prove the defining
     properties of the relativized \<^term>\<open>Aleph\<close> function
     (in particular, the required ability to perform transfinite recursions).\<close>
 
 thm Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit
 text\<open>@{thm [display] Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit}\<close>
 (*
   \<aleph>\<^bsub>0\<^esub>\<^bsup>M\<^esup> = \<omega>
   Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>succ(\<alpha>)\<^esub>\<^bsup>M\<^esup> = (\<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup>\<^sup>+)\<^bsup>M\<^esup>
   Limit(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup> = (\<Union>j\<in>\<alpha>. \<aleph>\<^bsub>j\<^esub>\<^bsup>M\<^esup>)
 *)
 
 end \<comment> \<open>\<^locale>\<open>M_aleph\<close>\<close>
 
 lemma ContHyp_rel_def':
   fixes N::"i\<Rightarrow>o"
   shows
     "CH\<^bsup>N\<^esup> \<equiv> \<aleph>\<^bsub>1\<^esub>\<^bsup>N\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>N\<^esup>,N\<^esup>"
   unfolding ContHyp_rel_def .
 
 text\<open>Under appropriate hypotheses (this time, from the locale \<^term>\<open>M_ZF_library\<close>),
    \<^term>\<open>CH\<^bsup>M\<^esup>\<close> is equivalent to its fully relational version \<^term>\<open>is_ContHyp\<close>.
     As a sanity check, we see that if the transitive class is indeed \<^term>\<open>\<V>\<close>,
     we recover the original $\CH$.\<close>
 
 thm M_ZF_library.is_ContHyp_iff is_ContHyp_iff_CH[unfolded ContHyp_def]
 text\<open>@{thm [display] M_ZF_library.is_ContHyp_iff
     is_ContHyp_iff_CH[unfolded ContHyp_def]}\<close>
 (*
   M_ZF_library(M) \<Longrightarrow> is_ContHyp(M) \<longleftrightarrow> CH\<^bsup>M\<^esup>
   is_ContHyp(\<V>) \<longleftrightarrow> \<aleph>\<^bsub>1\<^esub> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^esup>
 *)
 
 text\<open>In turn, the fully relational version evaluated on a nonempty
     transitive \<^term>\<open>A\<close> is equivalent to the satisfaction of the
     first-order formula \<^term>\<open>\<cdot>CH\<cdot>\<close>.\<close>
 thm is_ContHyp_iff_sats
 text\<open>@{thm [display] is_ContHyp_iff_sats}\<close>
 (*
   env \<in> list(A) \<Longrightarrow> 0 \<in> A \<Longrightarrow> is_ContHyp(##A) \<longleftrightarrow> A, env \<Turnstile> \<cdot>CH\<cdot>
 *)
 
 
 subsection\<open>Forcing \label{sec:def-main-forcing}\<close>
 
 text\<open>Our first milestone was to obtain a proper extension using forcing.
 Its original proof didn't required the previous developments involving
 the relativization of material on cardinal arithmetic. Now it is
 derived from a stronger result, namely @{thm [source] extensions_of_ctms}
 below.\<close>
 
 thm extensions_of_ctms_ZF
 text\<open>@{thm [display] extensions_of_ctms_ZF}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZF \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZF \<and> M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and> ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC)
 *)
 
 text\<open>We can finally state our main results, namely, the existence of models
 for $\ZFC + \CH$ and $\ZFC + \neg\CH$ under the assumption of a ctm of $\ZFC$.\<close>
 
 thm ctm_ZFC_imp_ctm_not_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_not_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_ZFC_imp_ctm_CH
 text\<open>@{thm [display] ctm_ZFC_imp_ctm_CH}\<close>
 (*
   M \<approx> \<omega> \<Longrightarrow>
   Transset(M) \<Longrightarrow>
   M \<Turnstile> ZFC \<Longrightarrow>
   \<exists>N. M \<subseteq> N \<and>
       N \<approx> \<omega> \<and>
       Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>CH\<cdot>} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>These results can be strengthened by enumerating six finite sets of
 replacement instances which are sufficient to develop forcing and for
 the construction of the aforementioned models: \<^term>\<open>instances1_fms\<close>
 through \<^term>\<open>instances3_fms\<close>, \<^term>\<open>instances_ground_fms\<close>, and
 \<^term>\<open>instances_ground_notCH_fms\<close>,
 which are then collected into the $31$-element set \<^term>\<open>overhead_notCH\<close>.
 For example, we have:\<close>
 
 thm instances1_fms_def
 text\<open>@{thm [display] instances1_fms_def}\<close>
 (*
 instances1_fms \<equiv>
-{ list_repl1_intf_fm, list_repl2_intf_fm, formula_repl1_intf_fm,
- formula_repl2_intf_fm, eclose_repl1_intf_fm, eclose_repl2_intf_fm,
- wfrec_rank_fm, trans_repl_HVFrom_fm, tl_repl_intf_fm }
+{ eclose_repl1_intf_fm, eclose_repl2_intf_fm,
+  wfrec_rank_fm, trans_repl_HVFrom_fm }
 *)
 
 thm overhead_def overhead_notCH_def
 text\<open>@{thm [display] overhead_def overhead_notCH_def overhead_CH_def}\<close>
 (*
   overhead \<equiv> instances1_fms \<union> instances_ground_fms
 
   overhead_notCH \<equiv> overhead \<union>
     instances2_fms \<union> instances3_fms \<union> instances_ground_notCH_fms
 *)
 
 text\<open>One further instance is needed to force $\CH$, with a total count
 of $32$ instances:\<close>
 thm overhead_CH_def
 text\<open>@{thm [display] overhead_CH_def}\<close>
 (*
   overhead_CH \<equiv> overhead_notCH \<union> {replacement_dcwit_repl_body_fm}
 *)
 
 thm extensions_of_ctms
 text\<open>@{thm [display] extensions_of_ctms}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     M \<noteq> N \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N) \<and>
     ((M, [] \<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}
 *)
 
 thm ctm_of_not_CH
 text\<open>@{thm [display] ctm_of_not_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 thm ctm_of_CH
 text\<open>@{thm [display] ctm_of_CH}\<close>
 (*
 M \<approx> \<omega> \<Longrightarrow>
 Transset(M) \<Longrightarrow>
 M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH} \<Longrightarrow>
 \<Phi> \<subseteq> formula \<Longrightarrow>
 M \<Turnstile> {\<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>} \<Longrightarrow>
 \<exists>N. M \<subseteq> N \<and>
     N \<approx> \<omega> \<and>
     Transset(N) \<and>
     N \<Turnstile> ZC \<union> {\<cdot>CH\<cdot>} \<union> {\<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
     (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)
 *)
 
 text\<open>In the above three statements, the function \<^term>\<open>ground_repl_fm\<close>
 takes an element \<^term>\<open>\<phi>\<close> of \<^term>\<open>formula\<close> and returns the
 replacement instance in the ground model that produces the
 \<^term>\<open>\<phi>\<close>-replacement instance in the generic extension. The next
 result is stated in the context \<^locale>\<open>G_generic1\<close>, which assumes
 the existence of a generic filter.\<close>
 
 context G_generic1
 begin
 
 thm sats_ground_repl_fm_imp_sats_ZF_replacement_fm
 text\<open>@{thm [display] sats_ground_repl_fm_imp_sats_ZF_replacement_fm}\<close>
 (*
   \<phi> \<in> formula \<Longrightarrow>
   M, [] \<Turnstile> \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> \<Longrightarrow> M[G], [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>
 *)
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forces_Definition.thy b/thys/Independence_CH/Forces_Definition.thy
--- a/thys/Independence_CH/Forces_Definition.thy
+++ b/thys/Independence_CH/Forces_Definition.thy
@@ -1,852 +1,853 @@
 section\<open>The definition of \<^term>\<open>forces\<close>\<close>
 
 theory Forces_Definition
   imports
     Forcing_Data
 begin
 
 text\<open>This is the core of our development.\<close>
 
 subsection\<open>The relation \<^term>\<open>frecrel\<close>\<close>
 
 lemma names_belowsD:
   assumes "x \<in> names_below(P,z)"
   obtains f n1 n2 p where
     "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>P"
   using assms unfolding names_below_def by auto
 
 context forcing_data1
 begin
 
 (* Absoluteness of components *)
 lemma ftype_abs:
   "\<lbrakk>x\<in>M; y\<in>M \<rbrakk> \<Longrightarrow> is_ftype(##M,x,y) \<longleftrightarrow> y = ftype(x)"
   unfolding ftype_def is_ftype_def by (simp add:absolut)
 
 lemma name1_abs:
   "\<lbrakk>x\<in>M; y\<in>M \<rbrakk> \<Longrightarrow> is_name1(##M,x,y) \<longleftrightarrow> y = name1(x)"
   unfolding name1_def is_name1_def
   by (rule is_hcomp_abs[OF fst_abs],simp_all add: fst_snd_closed[simplified] absolut)
 
 lemma snd_snd_abs:
   "\<lbrakk>x\<in>M; y\<in>M \<rbrakk> \<Longrightarrow> is_snd_snd(##M,x,y) \<longleftrightarrow> y = snd(snd(x))"
   unfolding is_snd_snd_def
   by (rule is_hcomp_abs[OF snd_abs],
       simp_all add: conjunct2[OF fst_snd_closed,simplified] absolut)
 
 lemma name2_abs:
   "\<lbrakk>x\<in>M; y\<in>M \<rbrakk> \<Longrightarrow> is_name2(##M,x,y) \<longleftrightarrow> y = name2(x)"
   unfolding name2_def is_name2_def
   by (rule is_hcomp_abs[OF fst_abs snd_snd_abs],simp_all add:absolut conjunct2[OF fst_snd_closed,simplified])
 
 lemma cond_of_abs:
   "\<lbrakk>x\<in>M; y\<in>M \<rbrakk> \<Longrightarrow> is_cond_of(##M,x,y) \<longleftrightarrow> y = cond_of(x)"
   unfolding cond_of_def is_cond_of_def
   by (rule is_hcomp_abs[OF snd_abs snd_snd_abs];simp_all add:fst_snd_closed[simplified])
 
 lemma tuple_abs:
   "\<lbrakk>z\<in>M;t1\<in>M;t2\<in>M;p\<in>M;t\<in>M\<rbrakk> \<Longrightarrow>
    is_tuple(##M,z,t1,t2,p,t) \<longleftrightarrow> t = \<langle>z,t1,t2,p\<rangle>"
   unfolding is_tuple_def using pair_in_M_iff by simp
 
 lemmas components_abs = ftype_abs name1_abs name2_abs cond_of_abs
   tuple_abs
 
 lemma comp_in_M:
   "p \<preceq> q \<Longrightarrow> p\<in>M"
   "p \<preceq> q \<Longrightarrow> q\<in>M"
   using transitivity[of _ leq] pair_in_M_iff by auto
 
 (* Absoluteness of Hfrc *)
 
 lemma eq_case_abs [simp]:
   assumes "t1\<in>M" "t2\<in>M" "p\<in>M" "f\<in>M"
-  shows "is_eq_case(##M,t1,t2,p,P,leq,f) \<longleftrightarrow> eq_case(t1,t2,p,P,leq,f)"
+  shows "is_eq_case(##M,t1,t2,p,\<bbbP>,leq,f) \<longleftrightarrow> eq_case(t1,t2,p,\<bbbP>,leq,f)"
 proof -
   have "q \<preceq> p \<Longrightarrow> q\<in>M" for q
     using comp_in_M by simp
   moreover
   have "\<langle>s,y\<rangle>\<in>t \<Longrightarrow> s\<in>domain(t)" if "t\<in>M" for s y t
     using that unfolding domain_def by auto
   ultimately
   have
-    "(\<forall>s\<in>M. s \<in> domain(t1) \<or> s \<in> domain(t2) \<longrightarrow> (\<forall>q\<in>M. q\<in>P \<and> q \<preceq> p \<longrightarrow>
+    "(\<forall>s\<in>M. s \<in> domain(t1) \<or> s \<in> domain(t2) \<longrightarrow> (\<forall>q\<in>M. q\<in>\<bbbP> \<and> q \<preceq> p \<longrightarrow>
                               (f ` \<langle>1, s, t1, q\<rangle> =1 \<longleftrightarrow> f ` \<langle>1, s, t2, q\<rangle>=1))) \<longleftrightarrow>
-    (\<forall>s. s \<in> domain(t1) \<or> s \<in> domain(t2) \<longrightarrow> (\<forall>q. q\<in>P \<and> q \<preceq> p \<longrightarrow>
+    (\<forall>s. s \<in> domain(t1) \<or> s \<in> domain(t2) \<longrightarrow> (\<forall>q. q\<in>\<bbbP> \<and> q \<preceq> p \<longrightarrow>
                                   (f ` \<langle>1, s, t1, q\<rangle> =1 \<longleftrightarrow> f ` \<langle>1, s, t2, q\<rangle>=1)))"
     using assms domain_trans[OF trans_M,of t1] domain_trans[OF trans_M,of t2]
     by auto
   then
   show ?thesis
     unfolding eq_case_def is_eq_case_def
     using assms pair_in_M_iff nat_into_M domain_closed apply_closed zero_in_M Un_closed
     by (simp add:components_abs)
 qed
 
 lemma mem_case_abs [simp]:
   assumes "t1\<in>M" "t2\<in>M" "p\<in>M" "f\<in>M"
-  shows "is_mem_case(##M,t1,t2,p,P,leq,f) \<longleftrightarrow> mem_case(t1,t2,p,P,leq,f)"
+  shows "is_mem_case(##M,t1,t2,p,\<bbbP>,leq,f) \<longleftrightarrow> mem_case(t1,t2,p,\<bbbP>,leq,f)"
 proof
   {
     fix v
-    assume "v\<in>P" "v \<preceq> p" "is_mem_case(##M,t1,t2,p,P,leq,f)"
+    assume "v\<in>\<bbbP>" "v \<preceq> p" "is_mem_case(##M,t1,t2,p,\<bbbP>,leq,f)"
     moreover
     from this
     have "v\<in>M" "\<langle>v,p\<rangle> \<in> M" "(##M)(v)"
       using transitivity[OF _ P_in_M,of v] transitivity[OF _ leq_in_M]
       by simp_all
     moreover
     from calculation assms
     obtain q r s where
-      "r \<in> P \<and> q \<in> P \<and> \<langle>q, v\<rangle> \<in> M \<and> \<langle>s, r\<rangle> \<in> M \<and> \<langle>q, r\<rangle> \<in> M \<and> 0 \<in> M \<and>
+      "r \<in> \<bbbP> \<and> q \<in> \<bbbP> \<and> \<langle>q, v\<rangle> \<in> M \<and> \<langle>s, r\<rangle> \<in> M \<and> \<langle>q, r\<rangle> \<in> M \<and> 0 \<in> M \<and>
        \<langle>0, t1, s, q\<rangle> \<in> M \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
       unfolding is_mem_case_def by (auto simp add:components_abs)
     then
-    have "\<exists>q s r. r \<in> P \<and> q \<in> P \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
+    have "\<exists>q s r. r \<in> \<bbbP> \<and> q \<in> \<bbbP> \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
       by auto
   }
   then
-  show "mem_case(t1, t2, p, P, leq, f)" if "is_mem_case(##M, t1, t2, p, P, leq, f)"
+  show "mem_case(t1, t2, p, \<bbbP>, leq, f)" if "is_mem_case(##M, t1, t2, p, \<bbbP>, leq, f)"
     unfolding mem_case_def using that assms by auto
 next
   { fix v
-    assume "v \<in> M" "v \<in> P" "\<langle>v, p\<rangle> \<in> M" "v \<preceq> p" "mem_case(t1, t2, p, P, leq, f)"
+    assume "v \<in> M" "v \<in> \<bbbP>" "\<langle>v, p\<rangle> \<in> M" "v \<preceq> p" "mem_case(t1, t2, p, \<bbbP>, leq, f)"
     moreover
     from this
-    obtain q s r where "r \<in> P \<and> q \<in> P \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
+    obtain q s r where "r \<in> \<bbbP> \<and> q \<in> \<bbbP> \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
       unfolding mem_case_def by auto
     moreover
     from this \<open>t2\<in>M\<close>
-    have "r\<in>M" "q\<in>M" "s\<in>M" "r \<in> P \<and> q \<in> P \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
+    have "r\<in>M" "q\<in>M" "s\<in>M" "r \<in> \<bbbP> \<and> q \<in> \<bbbP> \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
       using transitivity domainI[of s r] domain_closed
       by auto
     moreover
     note \<open>t1\<in>M\<close>
     ultimately
     have "\<exists>q\<in>M . \<exists>s\<in>M. \<exists>r\<in>M.
-         r \<in> P \<and> q \<in> P \<and> \<langle>q, v\<rangle> \<in> M \<and> \<langle>s, r\<rangle> \<in> M \<and> \<langle>q, r\<rangle> \<in> M \<and> 0 \<in> M \<and>
+         r \<in> \<bbbP> \<and> q \<in> \<bbbP> \<and> \<langle>q, v\<rangle> \<in> M \<and> \<langle>s, r\<rangle> \<in> M \<and> \<langle>q, r\<rangle> \<in> M \<and> 0 \<in> M \<and>
          \<langle>0, t1, s, q\<rangle> \<in> M \<and> q \<preceq> v \<and> \<langle>s, r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> f ` \<langle>0, t1, s, q\<rangle> = 1"
       using pair_in_M_iff zero_in_M by auto
   }
   then
-  show "is_mem_case(##M, t1, t2, p, P, leq, f)" if "mem_case(t1, t2, p, P, leq, f)"
+  show "is_mem_case(##M, t1, t2, p, \<bbbP>, leq, f)" if "mem_case(t1, t2, p, \<bbbP>, leq, f)"
     unfolding is_mem_case_def
     using assms that zero_in_M pair_in_M_iff apply_closed nat_into_M
     by (auto simp add:components_abs)
 qed
 
 lemma Hfrc_abs:
   "\<lbrakk>fnnc\<in>M; f\<in>M\<rbrakk> \<Longrightarrow>
-   is_Hfrc(##M,P,leq,fnnc,f) \<longleftrightarrow> Hfrc(P,leq,fnnc,f)"
+   is_Hfrc(##M,\<bbbP>,leq,fnnc,f) \<longleftrightarrow> Hfrc(\<bbbP>,leq,fnnc,f)"
   unfolding is_Hfrc_def Hfrc_def using pair_in_M_iff zero_in_M
   by (auto simp add:components_abs)
 
 lemma Hfrc_at_abs:
   "\<lbrakk>fnnc\<in>M; f\<in>M ; z\<in>M\<rbrakk> \<Longrightarrow>
-   is_Hfrc_at(##M,P,leq,fnnc,f,z) \<longleftrightarrow>  z = bool_of_o(Hfrc(P,leq,fnnc,f)) "
+   is_Hfrc_at(##M,\<bbbP>,leq,fnnc,f,z) \<longleftrightarrow>  z = bool_of_o(Hfrc(\<bbbP>,leq,fnnc,f)) "
   unfolding is_Hfrc_at_def using Hfrc_abs
   by auto
 
 lemma components_closed :
   "x\<in>M \<Longrightarrow> (##M)(ftype(x))"
   "x\<in>M \<Longrightarrow> (##M)(name1(x))"
   "x\<in>M \<Longrightarrow> (##M)(name2(x))"
   "x\<in>M \<Longrightarrow> (##M)(cond_of(x))"
   unfolding ftype_def name1_def name2_def cond_of_def using fst_snd_closed by simp_all
 
 lemma ecloseN_closed:
   "(##M)(A) \<Longrightarrow> (##M)(ecloseN(A))"
   "(##M)(A) \<Longrightarrow> (##M)(eclose_n(name1,A))"
   "(##M)(A) \<Longrightarrow> (##M)(eclose_n(name2,A))"
   unfolding ecloseN_def eclose_n_def
   using components_closed eclose_closed singleton_closed Un_closed by auto
 
 lemma eclose_n_abs :
   assumes "x\<in>M" "ec\<in>M"
   shows "is_eclose_n(##M,is_name1,ec,x) \<longleftrightarrow> ec = eclose_n(name1,x)"
     "is_eclose_n(##M,is_name2,ec,x) \<longleftrightarrow> ec = eclose_n(name2,x)"
   unfolding is_eclose_n_def eclose_n_def
   using assms name1_abs name2_abs eclose_abs singleton_closed components_closed
   by auto
 
 
 lemma ecloseN_abs :
   "\<lbrakk>x\<in>M;ec\<in>M\<rbrakk> \<Longrightarrow> is_ecloseN(##M,x,ec) \<longleftrightarrow> ec = ecloseN(x)"
   unfolding is_ecloseN_def ecloseN_def
   using eclose_n_abs Un_closed union_abs ecloseN_closed
   by auto
 
 lemma frecR_abs :
   "x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> frecR(x,y) \<longleftrightarrow> is_frecR(##M,x,y)"
   unfolding frecR_def is_frecR_def
   using zero_in_M domain_closed Un_closed components_closed nat_into_M
   by (auto simp add: components_abs)
 
 lemma frecrelP_abs :
   "z\<in>M \<Longrightarrow> frecrelP(##M,z) \<longleftrightarrow> (\<exists>x y. z = \<langle>x,y\<rangle> \<and> frecR(x,y))"
   using pair_in_M_iff frecR_abs unfolding frecrelP_def by auto
 
 lemma frecrel_abs:
   assumes "A\<in>M" "r\<in>M"
   shows "is_frecrel(##M,A,r) \<longleftrightarrow>  r = frecrel(A)"
 proof -
   from \<open>A\<in>M\<close>
   have "z\<in>M" if "z\<in>A\<times>A" for z
     using cartprod_closed transitivity that by simp
   then
   have "Collect(A\<times>A,frecrelP(##M)) = Collect(A\<times>A,\<lambda>z. (\<exists>x y. z = \<langle>x,y\<rangle> \<and> frecR(x,y)))"
     using Collect_cong[of "A\<times>A" "A\<times>A" "frecrelP(##M)"] assms frecrelP_abs by simp
   with assms
   show ?thesis
     unfolding is_frecrel_def def_frecrel using cartprod_closed
     by simp
 qed
 
 lemma frecrel_closed:
   assumes "x\<in>M"
   shows "frecrel(x)\<in>M"
 proof -
   have "Collect(x\<times>x,\<lambda>z. (\<exists>x y. z = \<langle>x,y\<rangle> \<and> frecR(x,y)))\<in>M"
     using Collect_in_M[of "frecrelP_fm(0)" "[]"] arity_frecrelP_fm sats_frecrelP_fm
       frecrelP_abs \<open>x\<in>M\<close> cartprod_closed
     by simp
   then
   show ?thesis
     unfolding frecrel_def Rrel_def frecrelP_def by simp
 qed
 
-lemma field_frecrel : "field(frecrel(names_below(P,x))) \<subseteq> names_below(P,x)"
+lemma field_frecrel : "field(frecrel(names_below(\<bbbP>,x))) \<subseteq> names_below(\<bbbP>,x)"
   unfolding frecrel_def
   using field_Rrel by simp
 
-lemma forcerelD : "uv \<in> forcerel(P,x) \<Longrightarrow> uv\<in> names_below(P,x) \<times> names_below(P,x)"
+lemma forcerelD : "uv \<in> forcerel(\<bbbP>,x) \<Longrightarrow> uv\<in> names_below(\<bbbP>,x) \<times> names_below(\<bbbP>,x)"
   unfolding forcerel_def
   using trancl_type field_frecrel by blast
 
 lemma wf_forcerel :
-  "wf(forcerel(P,x))"
+  "wf(forcerel(\<bbbP>,x))"
   unfolding forcerel_def using wf_trancl wf_frecrel .
 
 lemma restrict_trancl_forcerel:
   assumes "frecR(w,y)"
-  shows "restrict(f,frecrel(names_below(P,x))-``{y})`w
-       = restrict(f,forcerel(P,x)-``{y})`w"
+  shows "restrict(f,frecrel(names_below(\<bbbP>,x))-``{y})`w
+       = restrict(f,forcerel(\<bbbP>,x)-``{y})`w"
   unfolding forcerel_def frecrel_def using assms restrict_trancl_Rrel[of frecR]
   by simp
 
 lemma names_belowI :
-  assumes "frecR(\<langle>ft,n1,n2,p\<rangle>,\<langle>a,b,c,d\<rangle>)" "p\<in>P"
-  shows "\<langle>ft,n1,n2,p\<rangle> \<in> names_below(P,\<langle>a,b,c,d\<rangle>)" (is "?x \<in> names_below(_,?y)")
+  assumes "frecR(\<langle>ft,n1,n2,p\<rangle>,\<langle>a,b,c,d\<rangle>)" "p\<in>\<bbbP>"
+  shows "\<langle>ft,n1,n2,p\<rangle> \<in> names_below(\<bbbP>,\<langle>a,b,c,d\<rangle>)" (is "?x \<in> names_below(_,?y)")
 proof -
   from assms
   have "ft \<in> 2" "a \<in> 2"
     unfolding frecR_def by (auto simp add:components_simp)
   from assms
   consider (eq) "n1 \<in> domain(b) \<union> domain(c) \<and> (n2 = b \<or> n2 =c)"
     | (mem) "n1 = b \<and> n2 \<in> domain(c)"
     unfolding frecR_def by (auto simp add:components_simp)
   then show ?thesis
   proof cases
     case eq
     then
     have "n1 \<in> eclose(b) \<or> n1 \<in> eclose(c)"
       using Un_iff in_dom_in_eclose by auto
     with eq
     have "n1 \<in> ecloseN(?y)" "n2 \<in> ecloseN(?y)"
       using ecloseNI components_in_eclose by auto
-    with \<open>ft\<in>2\<close> \<open>p\<in>P\<close>
+    with \<open>ft\<in>2\<close> \<open>p\<in>\<bbbP>\<close>
     show ?thesis
       unfolding names_below_def by  auto
   next
     case mem
     then
     have "n1 \<in> ecloseN(?y)" "n2 \<in> ecloseN(?y)"
       using mem_eclose_trans ecloseNI in_dom_in_eclose components_in_eclose
       by auto
-    with \<open>ft\<in>2\<close> \<open>p\<in>P\<close>
+    with \<open>ft\<in>2\<close> \<open>p\<in>\<bbbP>\<close>
     show ?thesis
       unfolding names_below_def
       by auto
   qed
 qed
 
 lemma names_below_tr :
-  assumes "x\<in> names_below(P,y)" "y\<in> names_below(P,z)"
-  shows "x\<in> names_below(P,z)"
+  assumes "x\<in> names_below(\<bbbP>,y)" "y\<in> names_below(\<bbbP>,z)"
+  shows "x\<in> names_below(\<bbbP>,z)"
 proof -
-  let ?A="\<lambda>y . names_below(P,y)"
+  let ?A="\<lambda>y . names_below(\<bbbP>,y)"
   note assms
   moreover from this
-  obtain fx x1 x2 px where "x = \<langle>fx,x1,x2,px\<rangle>" "fx\<in>2" "x1\<in>ecloseN(y)" "x2\<in>ecloseN(y)" "px\<in>P"
+  obtain fx x1 x2 px where "x = \<langle>fx,x1,x2,px\<rangle>" "fx\<in>2" "x1\<in>ecloseN(y)" "x2\<in>ecloseN(y)" "px\<in>\<bbbP>"
     unfolding names_below_def by auto
   moreover from calculation
-  obtain fy y1 y2 py where "y = \<langle>fy,y1,y2,py\<rangle>" "fy\<in>2" "y1\<in>ecloseN(z)" "y2\<in>ecloseN(z)" "py\<in>P"
+  obtain fy y1 y2 py where "y = \<langle>fy,y1,y2,py\<rangle>" "fy\<in>2" "y1\<in>ecloseN(z)" "y2\<in>ecloseN(z)" "py\<in>\<bbbP>"
     unfolding names_below_def by auto
   moreover from calculation
   have "x1\<in>ecloseN(z)" "x2\<in>ecloseN(z)"
     using ecloseN_mono names_simp by auto
   ultimately
   have "x\<in>?A(z)"
     unfolding names_below_def by simp
   then
   show ?thesis using subsetI by simp
 qed
 
 lemma arg_into_names_below2 :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P,z))"
-  shows  "x \<in> names_below(P,y)"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,z))"
+  shows  "x \<in> names_below(\<bbbP>,y)"
 proof -
   from assms
-  have "x\<in>names_below(P,z)" "y\<in>names_below(P,z)" "frecR(x,y)"
+  have "x\<in>names_below(\<bbbP>,z)" "y\<in>names_below(\<bbbP>,z)" "frecR(x,y)"
     unfolding frecrel_def Rrel_def
     by auto
-  obtain f n1 n2 p where "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>P"
-    using \<open>x\<in>names_below(P,z)\<close>
+  obtain f n1 n2 p where "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>\<bbbP>"
+    using \<open>x\<in>names_below(\<bbbP>,z)\<close>
     unfolding names_below_def by auto
   moreover
-  obtain fy m1 m2 q where "q\<in>P" "y = \<langle>fy,m1,m2,q\<rangle>"
-    using \<open>y\<in>names_below(P,z)\<close>
+  obtain fy m1 m2 q where "q\<in>\<bbbP>" "y = \<langle>fy,m1,m2,q\<rangle>"
+    using \<open>y\<in>names_below(\<bbbP>,z)\<close>
     unfolding names_below_def by auto
   moreover
   note \<open>frecR(x,y)\<close>
   ultimately
   show ?thesis
     using names_belowI by simp
 qed
 
 lemma arg_into_names_below :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P,z))"
-  shows  "x \<in> names_below(P,x)"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,z))"
+  shows  "x \<in> names_below(\<bbbP>,x)"
 proof -
   from assms
-  have "x\<in>names_below(P,z)"
+  have "x\<in>names_below(\<bbbP>,z)"
     unfolding frecrel_def Rrel_def
     by auto
-  from \<open>x\<in>names_below(P,z)\<close>
+  from \<open>x\<in>names_below(\<bbbP>,z)\<close>
   obtain f n1 n2 p where
-    "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>P"
+    "x = \<langle>f,n1,n2,p\<rangle>" "f\<in>2" "n1\<in>ecloseN(z)" "n2\<in>ecloseN(z)" "p\<in>\<bbbP>"
     unfolding names_below_def by auto
   then
   have "n1\<in>ecloseN(x)" "n2\<in>ecloseN(x)"
     using components_in_eclose by simp_all
-  with \<open>f\<in>2\<close> \<open>p\<in>P\<close> \<open>x = \<langle>f,n1,n2,p\<rangle>\<close>
+  with \<open>f\<in>2\<close> \<open>p\<in>\<bbbP>\<close> \<open>x = \<langle>f,n1,n2,p\<rangle>\<close>
   show ?thesis
     unfolding names_below_def by simp
 qed
 
 lemma forcerel_arg_into_names_below :
-  assumes "\<langle>x,y\<rangle> \<in> forcerel(P,z)"
-  shows  "x \<in> names_below(P,x)"
+  assumes "\<langle>x,y\<rangle> \<in> forcerel(\<bbbP>,z)"
+  shows  "x \<in> names_below(\<bbbP>,x)"
   using assms
   unfolding forcerel_def
   by(rule trancl_induct;auto simp add: arg_into_names_below)
 
 lemma names_below_mono :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P,z))"
-  shows "names_below(P,x) \<subseteq> names_below(P,y)"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,z))"
+  shows "names_below(\<bbbP>,x) \<subseteq> names_below(\<bbbP>,y)"
 proof -
   from assms
-  have "x\<in>names_below(P,y)"
+  have "x\<in>names_below(\<bbbP>,y)"
     using arg_into_names_below2 by simp
   then
   show ?thesis
     using names_below_tr subsetI by simp
 qed
 
 lemma frecrel_mono :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P,z))"
-  shows "frecrel(names_below(P,x)) \<subseteq> frecrel(names_below(P,y))"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,z))"
+  shows "frecrel(names_below(\<bbbP>,x)) \<subseteq> frecrel(names_below(\<bbbP>,y))"
   unfolding frecrel_def
   using Rrel_mono names_below_mono assms by simp
 
 lemma forcerel_mono2 :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P,z))"
-  shows "forcerel(P,x) \<subseteq> forcerel(P,y)"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,z))"
+  shows "forcerel(\<bbbP>,x) \<subseteq> forcerel(\<bbbP>,y)"
   unfolding forcerel_def
   using trancl_mono frecrel_mono assms by simp
 
 lemma forcerel_mono_aux :
-  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(P, w))^+"
-  shows "forcerel(P,x) \<subseteq> forcerel(P,y)"
+  assumes "\<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>, w))^+"
+  shows "forcerel(\<bbbP>,x) \<subseteq> forcerel(\<bbbP>,y)"
   using assms
   by (rule trancl_induct,simp_all add: subset_trans forcerel_mono2)
 
 lemma forcerel_mono :
-  assumes "\<langle>x,y\<rangle> \<in> forcerel(P,z)"
-  shows "forcerel(P,x) \<subseteq> forcerel(P,y)"
+  assumes "\<langle>x,y\<rangle> \<in> forcerel(\<bbbP>,z)"
+  shows "forcerel(\<bbbP>,x) \<subseteq> forcerel(\<bbbP>,y)"
   using forcerel_mono_aux assms unfolding forcerel_def by simp
 
-lemma forcerel_eq_aux: "x \<in> names_below(P, w) \<Longrightarrow> \<langle>x,y\<rangle> \<in> forcerel(P,z) \<Longrightarrow>
-  (y \<in> names_below(P, w) \<longrightarrow> \<langle>x,y\<rangle> \<in> forcerel(P,w))"
+lemma forcerel_eq_aux: "x \<in> names_below(\<bbbP>, w) \<Longrightarrow> \<langle>x,y\<rangle> \<in> forcerel(\<bbbP>,z) \<Longrightarrow>
+  (y \<in> names_below(\<bbbP>, w) \<longrightarrow> \<langle>x,y\<rangle> \<in> forcerel(\<bbbP>,w))"
   unfolding forcerel_def
-proof(rule_tac a=x and b=y and P="\<lambda> y . y \<in> names_below(P, w) \<longrightarrow> \<langle>x,y\<rangle> \<in> frecrel(names_below(P,w))^+" in trancl_induct,simp)
-  let ?A="\<lambda> a . names_below(P, a)"
+proof (rule_tac a=x and b=y and
+    P="\<lambda> y . y \<in> names_below(\<bbbP>, w) \<longrightarrow> \<langle>x,y\<rangle> \<in> frecrel(names_below(\<bbbP>,w))^+" in trancl_induct,simp)
+  let ?A="\<lambda> a . names_below(\<bbbP>, a)"
   let ?R="\<lambda> a . frecrel(?A(a))"
   let ?fR="\<lambda> a .forcerel(a)"
   show "u\<in>?A(w) \<longrightarrow> \<langle>x,u\<rangle>\<in>?R(w)^+" if "x\<in>?A(w)" "\<langle>x,y\<rangle>\<in>?R(z)^+" "\<langle>x,u\<rangle>\<in>?R(z)"  for  u
     using that frecrelD frecrelI r_into_trancl
     unfolding names_below_def by simp
   {
     fix u v
     assume "x \<in> ?A(w)"
       "\<langle>x, y\<rangle> \<in> ?R(z)^+"
       "\<langle>x, u\<rangle> \<in> ?R(z)^+"
       "\<langle>u, v\<rangle> \<in> ?R(z)"
       "u \<in> ?A(w) \<Longrightarrow> \<langle>x, u\<rangle> \<in> ?R(w)^+"
     then
     have "v \<in> ?A(w) \<Longrightarrow> \<langle>x, v\<rangle> \<in> ?R(w)^+"
     proof -
       assume "v \<in>?A(w)"
       from \<open>\<langle>u,v\<rangle>\<in>_\<close>
       have "u\<in>?A(v)"
         using arg_into_names_below2 by simp
       with \<open>v \<in>?A(w)\<close>
       have "u\<in>?A(w)"
         using names_below_tr by simp
       with \<open>v\<in>_\<close> \<open>\<langle>u,v\<rangle>\<in>_\<close>
       have "\<langle>u,v\<rangle>\<in> ?R(w)"
         using frecrelD frecrelI r_into_trancl unfolding names_below_def by simp
       with \<open>u \<in> ?A(w) \<Longrightarrow> \<langle>x, u\<rangle> \<in> ?R(w)^+\<close> \<open>u\<in>?A(w)\<close>
       have "\<langle>x, u\<rangle> \<in> ?R(w)^+"
         by simp
       with \<open>\<langle>u,v\<rangle>\<in> ?R(w)\<close>
       show "\<langle>x,v\<rangle>\<in> ?R(w)^+" using trancl_trans r_into_trancl
         by simp
     qed
   }
   then
   show "v \<in> ?A(w) \<longrightarrow> \<langle>x, v\<rangle> \<in> ?R(w)^+"
     if "x \<in> ?A(w)"
       "\<langle>x, y\<rangle> \<in> ?R(z)^+"
       "\<langle>x, u\<rangle> \<in> ?R(z)^+"
       "\<langle>u, v\<rangle> \<in> ?R(z)"
       "u \<in> ?A(w) \<longrightarrow> \<langle>x, u\<rangle> \<in> ?R(w)^+" for u v
     using that
     by simp
 qed
 
 lemma forcerel_eq :
-  assumes "\<langle>z,x\<rangle> \<in> forcerel(P,x)"
-  shows "forcerel(P,z) = forcerel(P,x) \<inter> names_below(P,z)\<times>names_below(P,z)"
+  assumes "\<langle>z,x\<rangle> \<in> forcerel(\<bbbP>,x)"
+  shows "forcerel(\<bbbP>,z) = forcerel(\<bbbP>,x) \<inter> names_below(\<bbbP>,z)\<times>names_below(\<bbbP>,z)"
   using assms forcerel_eq_aux forcerelD forcerel_mono[of z x x] subsetI
   by auto
 
 lemma forcerel_below_aux :
-  assumes "\<langle>z,x\<rangle> \<in> forcerel(P,x)" "\<langle>u,z\<rangle> \<in> forcerel(P,x)"
-  shows "u \<in> names_below(P,z)"
+  assumes "\<langle>z,x\<rangle> \<in> forcerel(\<bbbP>,x)" "\<langle>u,z\<rangle> \<in> forcerel(\<bbbP>,x)"
+  shows "u \<in> names_below(\<bbbP>,z)"
   using assms(2)
   unfolding forcerel_def
 proof(rule trancl_induct)
-  show  "u \<in> names_below(P,y)" if " \<langle>u, y\<rangle> \<in> frecrel(names_below(P, x))" for y
+  show  "u \<in> names_below(\<bbbP>,y)" if " \<langle>u, y\<rangle> \<in> frecrel(names_below(\<bbbP>, x))" for y
     using that vimage_singleton_iff arg_into_names_below2 by simp
 next
-  show "u \<in> names_below(P,z)"
-    if "\<langle>u, y\<rangle> \<in> frecrel(names_below(P, x))^+"
-      "\<langle>y, z\<rangle> \<in> frecrel(names_below(P, x))"
-      "u \<in> names_below(P, y)"
+  show "u \<in> names_below(\<bbbP>,z)"
+    if "\<langle>u, y\<rangle> \<in> frecrel(names_below(\<bbbP>, x))^+"
+      "\<langle>y, z\<rangle> \<in> frecrel(names_below(\<bbbP>, x))"
+      "u \<in> names_below(\<bbbP>, y)"
     for y z
     using that arg_into_names_below2[of y z x] names_below_tr by simp
 qed
 
 lemma forcerel_below :
-  assumes "\<langle>z,x\<rangle> \<in> forcerel(P,x)"
-  shows "forcerel(P,x) -`` {z} \<subseteq> names_below(P,z)"
+  assumes "\<langle>z,x\<rangle> \<in> forcerel(\<bbbP>,x)"
+  shows "forcerel(\<bbbP>,x) -`` {z} \<subseteq> names_below(\<bbbP>,z)"
   using vimage_singleton_iff assms forcerel_below_aux by auto
 
 lemma relation_forcerel :
-  shows "relation(forcerel(P,z))" "trans(forcerel(P,z))"
+  shows "relation(forcerel(\<bbbP>,z))" "trans(forcerel(\<bbbP>,z))"
   unfolding forcerel_def using relation_trancl trans_trancl by simp_all
 
-lemma Hfrc_restrict_trancl: "bool_of_o(Hfrc(P, leq, y, restrict(f,frecrel(names_below(P,x))-``{y})))
-         = bool_of_o(Hfrc(P, leq, y, restrict(f,(frecrel(names_below(P,x))^+)-``{y})))"
+lemma Hfrc_restrict_trancl: "bool_of_o(Hfrc(\<bbbP>, leq, y, restrict(f,frecrel(names_below(\<bbbP>,x))-``{y})))
+         = bool_of_o(Hfrc(\<bbbP>, leq, y, restrict(f,(frecrel(names_below(\<bbbP>,x))^+)-``{y})))"
   unfolding Hfrc_def bool_of_o_def eq_case_def mem_case_def
   using restrict_trancl_forcerel frecRI1 frecRI2 frecRI3
   unfolding forcerel_def
   by simp
 
 (* Recursive definition of forces for atomic formulas using a transitive relation *)
-lemma frc_at_trancl: "frc_at(P,leq,z) = wfrec(forcerel(P,z),z,\<lambda>x f. bool_of_o(Hfrc(P,leq,x,f)))"
+lemma frc_at_trancl: "frc_at(\<bbbP>,leq,z) = wfrec(forcerel(\<bbbP>,z),z,\<lambda>x f. bool_of_o(Hfrc(\<bbbP>,leq,x,f)))"
   unfolding frc_at_def forcerel_def using wf_eq_trancl Hfrc_restrict_trancl by simp
 
 lemma forcerelI1 :
-  assumes "n1 \<in> domain(b) \<or> n1 \<in> domain(c)" "p\<in>P" "d\<in>P"
-  shows "\<langle>\<langle>1, n1, b, p\<rangle>, \<langle>0,b,c,d\<rangle>\<rangle>\<in> forcerel(P,\<langle>0,b,c,d\<rangle>)"
+  assumes "n1 \<in> domain(b) \<or> n1 \<in> domain(c)" "p\<in>\<bbbP>" "d\<in>\<bbbP>"
+  shows "\<langle>\<langle>1, n1, b, p\<rangle>, \<langle>0,b,c,d\<rangle>\<rangle>\<in> forcerel(\<bbbP>,\<langle>0,b,c,d\<rangle>)"
 proof -
   let ?x="\<langle>1, n1, b, p\<rangle>"
   let ?y="\<langle>0,b,c,d\<rangle>"
   from assms
   have "frecR(?x,?y)"
     using frecRI1 by simp
   then
-  have "?x\<in>names_below(P,?y)" "?y \<in> names_below(P,?y)"
+  have "?x\<in>names_below(\<bbbP>,?y)" "?y \<in> names_below(\<bbbP>,?y)"
     using names_belowI  assms components_in_eclose
     unfolding names_below_def by auto
   with \<open>frecR(?x,?y)\<close>
   show ?thesis
     unfolding forcerel_def frecrel_def
     using subsetD[OF r_subset_trancl[OF relation_Rrel]] RrelI
     by auto
 qed
 
 lemma forcerelI2 :
-  assumes "n1 \<in> domain(b) \<or> n1 \<in> domain(c)" "p\<in>P" "d\<in>P"
-  shows "\<langle>\<langle>1, n1, c, p\<rangle>, \<langle>0,b,c,d\<rangle>\<rangle>\<in> forcerel(P,\<langle>0,b,c,d\<rangle>)"
+  assumes "n1 \<in> domain(b) \<or> n1 \<in> domain(c)" "p\<in>\<bbbP>" "d\<in>\<bbbP>"
+  shows "\<langle>\<langle>1, n1, c, p\<rangle>, \<langle>0,b,c,d\<rangle>\<rangle>\<in> forcerel(\<bbbP>,\<langle>0,b,c,d\<rangle>)"
 proof -
   let ?x="\<langle>1, n1, c, p\<rangle>"
   let ?y="\<langle>0,b,c,d\<rangle>"
   note assms
   moreover from this
   have "frecR(?x,?y)"
     using frecRI2 by simp
   moreover from calculation
-  have "?x\<in>names_below(P,?y)" "?y \<in> names_below(P,?y)"
+  have "?x\<in>names_below(\<bbbP>,?y)" "?y \<in> names_below(\<bbbP>,?y)"
     using names_belowI components_in_eclose
     unfolding names_below_def by auto
   ultimately
   show ?thesis
     unfolding forcerel_def frecrel_def
     using subsetD[OF r_subset_trancl[OF relation_Rrel]] RrelI
     by auto
 qed
 
 lemma forcerelI3 :
-  assumes "\<langle>n2, r\<rangle> \<in> c" "p\<in>P" "d\<in>P" "r \<in> P"
-  shows "\<langle>\<langle>0, b, n2, p\<rangle>,\<langle>1, b, c, d\<rangle>\<rangle> \<in> forcerel(P,\<langle>1,b,c,d\<rangle>)"
+  assumes "\<langle>n2, r\<rangle> \<in> c" "p\<in>\<bbbP>" "d\<in>\<bbbP>" "r \<in> \<bbbP>"
+  shows "\<langle>\<langle>0, b, n2, p\<rangle>,\<langle>1, b, c, d\<rangle>\<rangle> \<in> forcerel(\<bbbP>,\<langle>1,b,c,d\<rangle>)"
 proof -
   let ?x="\<langle>0, b, n2, p\<rangle>"
   let ?y="\<langle>1, b, c, d\<rangle>"
   note assms
   moreover from this
   have "frecR(?x,?y)"
     using frecRI3 by simp
   moreover from calculation
-  have "?x\<in>names_below(P,?y)"  "?y \<in> names_below(P,?y)"
+  have "?x\<in>names_below(\<bbbP>,?y)"  "?y \<in> names_below(\<bbbP>,?y)"
     using names_belowI components_in_eclose
     unfolding names_below_def by auto
   ultimately
   show ?thesis
     unfolding forcerel_def frecrel_def
     using subsetD[OF r_subset_trancl[OF relation_Rrel]] RrelI
     by auto
 qed
 
 lemmas forcerelI = forcerelI1[THEN vimage_singleton_iff[THEN iffD2]]
   forcerelI2[THEN vimage_singleton_iff[THEN iffD2]]
   forcerelI3[THEN vimage_singleton_iff[THEN iffD2]]
 
 lemma  aux_def_frc_at:
-  assumes "z \<in> forcerel(P,x) -`` {x}"
-  shows "wfrec(forcerel(P,x), z, H) =  wfrec(forcerel(P,z), z, H)"
+  assumes "z \<in> forcerel(\<bbbP>,x) -`` {x}"
+  shows "wfrec(forcerel(\<bbbP>,x), z, H) =  wfrec(forcerel(\<bbbP>,z), z, H)"
 proof -
-  let ?A="names_below(P,z)"
+  let ?A="names_below(\<bbbP>,z)"
   from assms
-  have "\<langle>z,x\<rangle> \<in> forcerel(P,x)"
+  have "\<langle>z,x\<rangle> \<in> forcerel(\<bbbP>,x)"
     using vimage_singleton_iff by simp
   moreover from this
   have "z \<in> ?A"
     using forcerel_arg_into_names_below by simp
   moreover from calculation
-  have "forcerel(P,z) = forcerel(P,x) \<inter> (?A\<times>?A)"
-    "forcerel(P,x) -`` {z} \<subseteq> ?A"
+  have "forcerel(\<bbbP>,z) = forcerel(\<bbbP>,x) \<inter> (?A\<times>?A)"
+    "forcerel(\<bbbP>,x) -`` {z} \<subseteq> ?A"
     using forcerel_eq forcerel_below
     by auto
   moreover from calculation
-  have "wfrec(forcerel(P,x), z, H) = wfrec[?A](forcerel(P,x), z, H)"
+  have "wfrec(forcerel(\<bbbP>,x), z, H) = wfrec[?A](forcerel(\<bbbP>,x), z, H)"
     using wfrec_trans_restr[OF relation_forcerel(1) wf_forcerel relation_forcerel(2), of x z ?A]
     by simp
   ultimately
   show ?thesis
     using wfrec_restr_eq by simp
 qed
 
 subsection\<open>Recursive expression of \<^term>\<open>frc_at\<close>\<close>
 
 lemma def_frc_at :
-  assumes "p\<in>P"
+  assumes "p\<in>\<bbbP>"
   shows
-    "frc_at(P,leq,\<langle>ft,n1,n2,p\<rangle>) =
-   bool_of_o( p \<in>P \<and>
+    "frc_at(\<bbbP>,leq,\<langle>ft,n1,n2,p\<rangle>) =
+   bool_of_o( p \<in>\<bbbP> \<and>
   (  ft = 0 \<and>  (\<forall>s. s\<in>domain(n1) \<union> domain(n2) \<longrightarrow>
-        (\<forall>q. q\<in>P \<and> q \<preceq> p \<longrightarrow> (frc_at(P,leq,\<langle>1,s,n1,q\<rangle>) =1 \<longleftrightarrow> frc_at(P,leq,\<langle>1,s,n2,q\<rangle>) =1)))
-   \<or> ft = 1 \<and> ( \<forall>v\<in>P. v \<preceq> p \<longrightarrow>
-    (\<exists>q. \<exists>s. \<exists>r. r\<in>P \<and> q\<in>P \<and> q \<preceq> v \<and> \<langle>s,r\<rangle> \<in> n2 \<and> q \<preceq> r \<and>  frc_at(P,leq,\<langle>0,n1,s,q\<rangle>) = 1))))"
+        (\<forall>q. q\<in>\<bbbP> \<and> q \<preceq> p \<longrightarrow> (frc_at(\<bbbP>,leq,\<langle>1,s,n1,q\<rangle>) =1 \<longleftrightarrow> frc_at(\<bbbP>,leq,\<langle>1,s,n2,q\<rangle>) =1)))
+   \<or> ft = 1 \<and> ( \<forall>v\<in>\<bbbP>. v \<preceq> p \<longrightarrow>
+    (\<exists>q. \<exists>s. \<exists>r. r\<in>\<bbbP> \<and> q\<in>\<bbbP> \<and> q \<preceq> v \<and> \<langle>s,r\<rangle> \<in> n2 \<and> q \<preceq> r \<and>  frc_at(\<bbbP>,leq,\<langle>0,n1,s,q\<rangle>) = 1))))"
 proof -
-  let ?r="\<lambda>y. forcerel(P,y)" and ?Hf="\<lambda>x f. bool_of_o(Hfrc(P,leq,x,f))"
+  let ?r="\<lambda>y. forcerel(\<bbbP>,y)" and ?Hf="\<lambda>x f. bool_of_o(Hfrc(\<bbbP>,leq,x,f))"
   let ?t="\<lambda>y. ?r(y) -`` {y}"
   let ?arg="\<langle>ft,n1,n2,p\<rangle>"
   from wf_forcerel
   have wfr: "\<forall>w . wf(?r(w))" ..
   with wfrec [of "?r(?arg)" ?arg ?Hf]
-  have "frc_at(P,leq,?arg) = ?Hf( ?arg, \<lambda>x\<in>?r(?arg) -`` {?arg}. wfrec(?r(?arg), x, ?Hf))"
+  have "frc_at(\<bbbP>,leq,?arg) = ?Hf( ?arg, \<lambda>x\<in>?r(?arg) -`` {?arg}. wfrec(?r(?arg), x, ?Hf))"
     using frc_at_trancl by simp
   also
-  have " ... = ?Hf( ?arg, \<lambda>x\<in>?r(?arg) -`` {?arg}. frc_at(P,leq,x))"
+  have " ... = ?Hf( ?arg, \<lambda>x\<in>?r(?arg) -`` {?arg}. frc_at(\<bbbP>,leq,x))"
     using aux_def_frc_at frc_at_trancl by simp
   finally
   show ?thesis
     unfolding Hfrc_def mem_case_def eq_case_def
     using forcerelI  assms
     by auto
 qed
 
 
 subsection\<open>Absoluteness of \<^term>\<open>frc_at\<close>\<close>
 
 lemma forcerel_in_M :
   assumes "x\<in>M"
-  shows "forcerel(P,x)\<in>M"
+  shows "forcerel(\<bbbP>,x)\<in>M"
   unfolding forcerel_def def_frecrel names_below_def
 proof -
-  let ?Q = "2 \<times> ecloseN(x) \<times> ecloseN(x) \<times> P"
+  let ?Q = "2 \<times> ecloseN(x) \<times> ecloseN(x) \<times> \<bbbP>"
   have "?Q \<times> ?Q \<in> M"
     using \<open>x\<in>M\<close> nat_into_M ecloseN_closed cartprod_closed by simp
   moreover
   have "separation(##M,\<lambda>z. frecrelP(##M,z))"
     using separation_in_ctm[of "frecrelP_fm(0)",OF _ _ _ sats_frecrelP_fm]
       arity_frecrelP_fm frecrelP_fm_type
     by auto
   moreover from this
   have "separation(##M,\<lambda>z. \<exists>x y. z = \<langle>x, y\<rangle> \<and> frecR(x, y))"
     using separation_cong[OF frecrelP_abs]
     by force
   ultimately
   show "{z \<in> ?Q \<times> ?Q . \<exists>x y. z = \<langle>x, y\<rangle> \<and> frecR(x, y)}^+ \<in> M"
     using separation_closed frecrelP_abs trancl_closed
     by simp
 qed
 
 lemma relation2_Hfrc_at_abs:
-  "relation2(##M,is_Hfrc_at(##M,P,leq),\<lambda>x f. bool_of_o(Hfrc(P,leq,x,f)))"
+  "relation2(##M,is_Hfrc_at(##M,\<bbbP>,leq),\<lambda>x f. bool_of_o(Hfrc(\<bbbP>,leq,x,f)))"
   unfolding relation2_def using Hfrc_at_abs
   by simp
 
 lemma Hfrc_at_closed :
-  "\<forall>x\<in>M. \<forall>g\<in>M. function(g) \<longrightarrow> bool_of_o(Hfrc(P,leq,x,g))\<in>M"
+  "\<forall>x\<in>M. \<forall>g\<in>M. function(g) \<longrightarrow> bool_of_o(Hfrc(\<bbbP>,leq,x,g))\<in>M"
   unfolding bool_of_o_def using zero_in_M nat_into_M[of 1] by simp
 
 lemma wfrec_Hfrc_at :
   assumes "X\<in>M"
-  shows "wfrec_replacement(##M,is_Hfrc_at(##M,P,leq),forcerel(P,X))"
+  shows "wfrec_replacement(##M,is_Hfrc_at(##M,\<bbbP>,leq),forcerel(\<bbbP>,X))"
 proof -
-  have 0:"is_Hfrc_at(##M,P,leq,a,b,c) \<longleftrightarrow>
-        sats(M,Hfrc_at_fm(8,9,2,1,0),[c,b,a,d,e,y,x,z,P,leq,forcerel(P,X)])"
+  have 0:"is_Hfrc_at(##M,\<bbbP>,leq,a,b,c) \<longleftrightarrow>
+        sats(M,Hfrc_at_fm(8,9,2,1,0),[c,b,a,d,e,y,x,z,\<bbbP>,leq,forcerel(\<bbbP>,X)])"
     if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "y\<in>M" "x\<in>M" "z\<in>M"
     for a b c d e y x z
     using that \<open>X\<in>M\<close> forcerel_in_M
-      Hfrc_at_iff_sats[of concl:M P leq a b c 8 9 2 1 0]
+      Hfrc_at_iff_sats[of concl:M \<bbbP> leq a b c 8 9 2 1 0]
     by simp
-  have 1:"sats(M,is_wfrec_fm(Hfrc_at_fm(8,9,2,1,0),5,1,0),[y,x,z,P,leq,forcerel(P,X)]) \<longleftrightarrow>
-                   is_wfrec(##M, is_Hfrc_at(##M,P,leq),forcerel(P,X), x, y)"
+  have 1:"sats(M,is_wfrec_fm(Hfrc_at_fm(8,9,2,1,0),5,1,0),[y,x,z,\<bbbP>,leq,forcerel(\<bbbP>,X)]) \<longleftrightarrow>
+                   is_wfrec(##M, is_Hfrc_at(##M,\<bbbP>,leq),forcerel(\<bbbP>,X), x, y)"
     if "x\<in>M" "y\<in>M" "z\<in>M" for x y z
     using that \<open>X\<in>M\<close> forcerel_in_M sats_is_wfrec_fm[OF 0]
     by simp
   let
     ?f="Exists(And(pair_fm(1,0,2),is_wfrec_fm(Hfrc_at_fm(8,9,2,1,0),5,1,0)))"
-  have satsf:"sats(M, ?f, [x,z,P,leq,forcerel(P,X)]) \<longleftrightarrow>
-              (\<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hfrc_at(##M,P,leq),forcerel(P,X), x, y))"
+  have satsf:"sats(M, ?f, [x,z,\<bbbP>,leq,forcerel(\<bbbP>,X)]) \<longleftrightarrow>
+              (\<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hfrc_at(##M,\<bbbP>,leq),forcerel(\<bbbP>,X), x, y))"
     if "x\<in>M" "z\<in>M" for x z
     using that 1 \<open>X\<in>M\<close> forcerel_in_M by (simp del:pair_abs)
   have artyf:"arity(?f) = 5"
     using arity_wfrec_replacement_fm[where p="Hfrc_at_fm(8,9,2,1,0)" and i=10]
       arity_Hfrc_at_fm ord_simp_union
     by simp
   moreover
   have "?f\<in>formula" by simp
   ultimately
-  have "strong_replacement(##M,\<lambda>x z. sats(M,?f,[x,z,P,leq,forcerel(P,X)]))"
+  have "strong_replacement(##M,\<lambda>x z. sats(M,?f,[x,z,\<bbbP>,leq,forcerel(\<bbbP>,X)]))"
     using ZF_ground_replacements(1) 1 artyf \<open>X\<in>M\<close> forcerel_in_M
     unfolding replacement_assm_def wfrec_Hfrc_at_fm_def by simp
   then
   have "strong_replacement(##M,\<lambda>x z.
-          \<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hfrc_at(##M,P,leq),forcerel(P,X), x, y))"
-    using repl_sats[of M ?f "[P,leq,forcerel(P,X)]"] satsf by (simp del:pair_abs)
+          \<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hfrc_at(##M,\<bbbP>,leq),forcerel(\<bbbP>,X), x, y))"
+    using repl_sats[of M ?f "[\<bbbP>,leq,forcerel(\<bbbP>,X)]"] satsf by (simp del:pair_abs)
   then
   show ?thesis unfolding wfrec_replacement_def by simp
 qed
 
 lemma names_below_abs :
   "\<lbrakk>Q\<in>M;x\<in>M;nb\<in>M\<rbrakk> \<Longrightarrow> is_names_below(##M,Q,x,nb) \<longleftrightarrow> nb = names_below(Q,x)"
   unfolding is_names_below_def names_below_def
   using succ_in_M_iff zero_in_M cartprod_closed ecloseN_abs ecloseN_closed
   by auto
 
 lemma names_below_closed:
   "\<lbrakk>Q\<in>M;x\<in>M\<rbrakk> \<Longrightarrow> names_below(Q,x) \<in> M"
   unfolding names_below_def
   using zero_in_M cartprod_closed ecloseN_closed succ_in_M_iff
   by simp
 
 lemma "names_below_productE" :
   assumes "Q \<in> M" "x \<in> M"
     "\<And>A1 A2 A3 A4. A1 \<in> M \<Longrightarrow> A2 \<in> M \<Longrightarrow> A3 \<in> M \<Longrightarrow> A4 \<in> M \<Longrightarrow> R(A1 \<times> A2 \<times> A3 \<times> A4)"
   shows "R(names_below(Q,x))"
   unfolding names_below_def using assms nat_into_M ecloseN_closed[of x] by auto
 
 lemma forcerel_abs :
-  "\<lbrakk>x\<in>M;z\<in>M\<rbrakk> \<Longrightarrow> is_forcerel(##M,P,x,z) \<longleftrightarrow> z = forcerel(P,x)"
+  "\<lbrakk>x\<in>M;z\<in>M\<rbrakk> \<Longrightarrow> is_forcerel(##M,\<bbbP>,x,z) \<longleftrightarrow> z = forcerel(\<bbbP>,x)"
   unfolding is_forcerel_def forcerel_def
   using frecrel_abs names_below_abs trancl_abs ecloseN_closed names_below_closed
     names_below_productE[of concl:"\<lambda>p. is_frecrel(##M,p,_) \<longleftrightarrow>  _ = frecrel(p)"] frecrel_closed
   by simp
 
 lemma frc_at_abs:
   assumes "fnnc\<in>M" "z\<in>M"
-  shows "is_frc_at(##M,P,leq,fnnc,z) \<longleftrightarrow> z = frc_at(P,leq,fnnc)"
+  shows "is_frc_at(##M,\<bbbP>,leq,fnnc,z) \<longleftrightarrow> z = frc_at(\<bbbP>,leq,fnnc)"
 proof -
   from assms
-  have "(\<exists>r\<in>M. is_forcerel(##M,P,fnnc, r) \<and> is_wfrec(##M, is_Hfrc_at(##M, P, leq), r, fnnc, z))
-        \<longleftrightarrow> is_wfrec(##M, is_Hfrc_at(##M, P, leq), forcerel(P,fnnc), fnnc, z)"
+  have "(\<exists>r\<in>M. is_forcerel(##M,\<bbbP>,fnnc, r) \<and> is_wfrec(##M, is_Hfrc_at(##M, \<bbbP>, leq), r, fnnc, z))
+        \<longleftrightarrow> is_wfrec(##M, is_Hfrc_at(##M, \<bbbP>, leq), forcerel(\<bbbP>,fnnc), fnnc, z)"
     using forcerel_abs forcerel_in_M by simp
   then
   show ?thesis
     unfolding frc_at_trancl is_frc_at_def
     using assms wfrec_Hfrc_at[of fnnc] wf_forcerel relation_forcerel forcerel_in_M
       Hfrc_at_closed relation2_Hfrc_at_abs
-      trans_wfrec_abs[of "forcerel(P,fnnc)" fnnc z "is_Hfrc_at(##M,P,leq)" "\<lambda>x f. bool_of_o(Hfrc(P,leq,x,f))"]
+      trans_wfrec_abs[of "forcerel(\<bbbP>,fnnc)" fnnc z "is_Hfrc_at(##M,\<bbbP>,leq)" "\<lambda>x f. bool_of_o(Hfrc(\<bbbP>,leq,x,f))"]
     by (simp flip:setclass_iff)
 qed
 
 lemma forces_eq'_abs :
-  "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_eq'(##M,P,leq,p,t1,t2) \<longleftrightarrow> forces_eq'(P,leq,p,t1,t2)"
+  "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_eq'(##M,\<bbbP>,leq,p,t1,t2) \<longleftrightarrow> forces_eq'(\<bbbP>,leq,p,t1,t2)"
   unfolding is_forces_eq'_def forces_eq'_def
   using frc_at_abs nat_into_M pair_in_M_iff by (auto simp add:components_abs)
 
 lemma forces_mem'_abs :
-  "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_mem'(##M,P,leq,p,t1,t2) \<longleftrightarrow> forces_mem'(P,leq,p,t1,t2)"
+  "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_mem'(##M,\<bbbP>,leq,p,t1,t2) \<longleftrightarrow> forces_mem'(\<bbbP>,leq,p,t1,t2)"
   unfolding is_forces_mem'_def forces_mem'_def
   using frc_at_abs nat_into_M pair_in_M_iff by (auto simp add:components_abs)
 
 lemma forces_neq'_abs :
   assumes "p\<in>M" "t1\<in>M" "t2\<in>M"
-  shows "is_forces_neq'(##M,P,leq,p,t1,t2) \<longleftrightarrow> forces_neq'(P,leq,p,t1,t2)"
+  shows "is_forces_neq'(##M,\<bbbP>,leq,p,t1,t2) \<longleftrightarrow> forces_neq'(\<bbbP>,leq,p,t1,t2)"
 proof -
-  have "q\<in>M" if "q\<in>P" for q
+  have "q\<in>M" if "q\<in>\<bbbP>" for q
     using that transitivity by simp
   with assms
   show ?thesis
     unfolding is_forces_neq'_def forces_neq'_def
     using forces_eq'_abs pair_in_M_iff
     by (auto simp add:components_abs,blast)
 qed
 
 lemma forces_nmem'_abs :
   assumes "p\<in>M" "t1\<in>M" "t2\<in>M"
-  shows "is_forces_nmem'(##M,P,leq,p,t1,t2) \<longleftrightarrow> forces_nmem'(P,leq,p,t1,t2)"
+  shows "is_forces_nmem'(##M,\<bbbP>,leq,p,t1,t2) \<longleftrightarrow> forces_nmem'(\<bbbP>,leq,p,t1,t2)"
 proof -
-  have "q\<in>M" if "q\<in>P" for q
+  have "q\<in>M" if "q\<in>\<bbbP>" for q
     using that transitivity by simp
   with assms
   show ?thesis
     unfolding is_forces_nmem'_def forces_nmem'_def
     using forces_mem'_abs pair_in_M_iff
     by (auto simp add:components_abs,blast)
 qed
 
 lemma leq_abs:
   "\<lbrakk> l\<in>M ; q\<in>M ; p\<in>M \<rbrakk> \<Longrightarrow> is_leq(##M,l,q,p) \<longleftrightarrow> \<langle>q,p\<rangle>\<in>l"
   unfolding is_leq_def using pair_in_M_iff by simp
 
 subsection\<open>Forcing for atomic formulas in context\<close>
 
 definition
   forces_eq :: "[i,i,i] \<Rightarrow> o" (\<open>_ forces\<^sub>a '(_ = _')\<close> [36,1,1] 60) where
-  "forces_eq \<equiv> forces_eq'(P,leq)"
+  "forces_eq \<equiv> forces_eq'(\<bbbP>,leq)"
 
 definition
   forces_mem :: "[i,i,i] \<Rightarrow> o" (\<open>_ forces\<^sub>a '(_ \<in> _')\<close> [36,1,1] 60) where
-  "forces_mem \<equiv> forces_mem'(P,leq)"
+  "forces_mem \<equiv> forces_mem'(\<bbbP>,leq)"
 
-(* frc_at(P,leq,\<langle>0,t1,t2,p\<rangle>) = 1*)
+(* frc_at(\<bbbP>,leq,\<langle>0,t1,t2,p\<rangle>) = 1*)
 abbreviation is_forces_eq
-  where "is_forces_eq \<equiv> is_forces_eq'(##M,P,leq)"
+  where "is_forces_eq \<equiv> is_forces_eq'(##M,\<bbbP>,leq)"
 
-(* frc_at(P,leq,\<langle>1,t1,t2,p\<rangle>) = 1*)
+(* frc_at(\<bbbP>,leq,\<langle>1,t1,t2,p\<rangle>) = 1*)
 abbreviation
   is_forces_mem :: "[i,i,i] \<Rightarrow> o" where
-  "is_forces_mem \<equiv> is_forces_mem'(##M,P,leq)"
+  "is_forces_mem \<equiv> is_forces_mem'(##M,\<bbbP>,leq)"
 
-lemma def_forces_eq: "p\<in>P \<Longrightarrow> p forces\<^sub>a (t1 = t2) \<longleftrightarrow>
-      (\<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q\<in>P \<and> q \<preceq> p \<longrightarrow>
+lemma def_forces_eq: "p\<in>\<bbbP> \<Longrightarrow> p forces\<^sub>a (t1 = t2) \<longleftrightarrow>
+      (\<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q\<in>\<bbbP> \<and> q \<preceq> p \<longrightarrow>
       (q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)))"
   unfolding forces_eq_def forces_mem_def forces_eq'_def forces_mem'_def
   using def_frc_at[of p 0 t1 t2 ]
   unfolding bool_of_o_def
   by auto
 
-lemma def_forces_mem: "p\<in>P \<Longrightarrow> p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow>
-     (\<forall>v\<in>P. v \<preceq> p \<longrightarrow>
-      (\<exists>q. \<exists>s. \<exists>r. r\<in>P \<and> q\<in>P \<and> q \<preceq> v \<and> \<langle>s,r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> q forces\<^sub>a (t1 = s)))"
+lemma def_forces_mem: "p\<in>\<bbbP> \<Longrightarrow> p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow>
+     (\<forall>v\<in>\<bbbP>. v \<preceq> p \<longrightarrow>
+      (\<exists>q. \<exists>s. \<exists>r. r\<in>\<bbbP> \<and> q\<in>\<bbbP> \<and> q \<preceq> v \<and> \<langle>s,r\<rangle> \<in> t2 \<and> q \<preceq> r \<and> q forces\<^sub>a (t1 = s)))"
   unfolding forces_eq'_def forces_mem'_def forces_eq_def forces_mem_def
   using def_frc_at[of p 1 t1 t2]
   unfolding bool_of_o_def
   by auto
 
 lemma forces_eq_abs :
   "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_eq(p,t1,t2) \<longleftrightarrow> p forces\<^sub>a (t1 = t2)"
   unfolding forces_eq_def
   using forces_eq'_abs by simp
 
 lemma forces_mem_abs :
   "\<lbrakk>p\<in>M ; t1\<in>M ; t2\<in>M\<rbrakk> \<Longrightarrow> is_forces_mem(p,t1,t2) \<longleftrightarrow> p forces\<^sub>a (t1 \<in> t2)"
   unfolding forces_mem_def
   using forces_mem'_abs
   by simp
 
 definition
   forces_neq :: "[i,i,i] \<Rightarrow> o" (\<open>_ forces\<^sub>a '(_ \<noteq> _')\<close> [36,1,1] 60) where
-  "p forces\<^sub>a (t1 \<noteq> t2) \<equiv> \<not> (\<exists>q\<in>P. q\<preceq>p \<and> q forces\<^sub>a (t1 = t2))"
+  "p forces\<^sub>a (t1 \<noteq> t2) \<equiv> \<not> (\<exists>q\<in>\<bbbP>. q\<preceq>p \<and> q forces\<^sub>a (t1 = t2))"
 
 definition
   forces_nmem :: "[i,i,i] \<Rightarrow> o" (\<open>_ forces\<^sub>a '(_ \<notin> _')\<close> [36,1,1] 60) where
-  "p forces\<^sub>a (t1 \<notin> t2) \<equiv> \<not> (\<exists>q\<in>P. q\<preceq>p \<and> q forces\<^sub>a (t1 \<in> t2))"
+  "p forces\<^sub>a (t1 \<notin> t2) \<equiv> \<not> (\<exists>q\<in>\<bbbP>. q\<preceq>p \<and> q forces\<^sub>a (t1 \<in> t2))"
 
 lemma forces_neq :
-  "p forces\<^sub>a (t1 \<noteq> t2) \<longleftrightarrow> forces_neq'(P,leq,p,t1,t2)"
+  "p forces\<^sub>a (t1 \<noteq> t2) \<longleftrightarrow> forces_neq'(\<bbbP>,leq,p,t1,t2)"
   unfolding forces_neq_def forces_neq'_def forces_eq_def by simp
 
 lemma forces_nmem :
-  "p forces\<^sub>a (t1 \<notin> t2) \<longleftrightarrow> forces_nmem'(P,leq,p,t1,t2)"
+  "p forces\<^sub>a (t1 \<notin> t2) \<longleftrightarrow> forces_nmem'(\<bbbP>,leq,p,t1,t2)"
   unfolding forces_nmem_def forces_nmem'_def forces_mem_def by simp
 
 abbreviation Forces :: "[i, i, i] \<Rightarrow> o"  ("_ \<tturnstile> _ _" [36,36,36] 60) where
-  "p \<tturnstile> \<phi> env   \<equiv>   M, ([p,P,leq,\<one>] @ env) \<Turnstile> forces(\<phi>)"
+  "p \<tturnstile> \<phi> env   \<equiv>   M, ([p,\<bbbP>,leq,\<one>] @ env) \<Turnstile> forces(\<phi>)"
 
 lemma sats_forces_Member :
   assumes  "x\<in>nat" "y\<in>nat" "env\<in>list(M)"
     "nth(x,env)=xx" "nth(y,env)=yy" "q\<in>M"
-  shows "q \<tturnstile> \<cdot>x \<in> y\<cdot> env \<longleftrightarrow> q \<in> P \<and> is_forces_mem(q, xx, yy)"
+  shows "q \<tturnstile> \<cdot>x \<in> y\<cdot> env \<longleftrightarrow> q \<in> \<bbbP> \<and> is_forces_mem(q, xx, yy)"
   unfolding forces_def
   using assms
   by simp
 
 lemma sats_forces_Equal :
   assumes "a\<in>nat" "b\<in>nat" "env\<in>list(M)" "nth(a,env)=x" "nth(b,env)=y" "q\<in>M"
-  shows "q \<tturnstile> \<cdot>a = b\<cdot> env \<longleftrightarrow> q \<in> P \<and> is_forces_eq(q, x, y)"
+  shows "q \<tturnstile> \<cdot>a = b\<cdot> env \<longleftrightarrow> q \<in> \<bbbP> \<and> is_forces_eq(q, x, y)"
   unfolding forces_def
   using assms
   by simp
 
 lemma sats_forces_Nand :
   assumes "\<phi>\<in>formula" "\<psi>\<in>formula" "env\<in>list(M)" "p\<in>M"
   shows "p \<tturnstile> \<cdot>\<not>(\<phi> \<and> \<psi>)\<cdot> env \<longleftrightarrow>
-    p\<in>P \<and> \<not>(\<exists>q\<in>M. q\<in>P \<and> is_leq(##M,leq,q,p) \<and> (q \<tturnstile> \<phi> env) \<and> (q \<tturnstile> \<psi> env))"
+    p\<in>\<bbbP> \<and> \<not>(\<exists>q\<in>M. q\<in>\<bbbP> \<and> is_leq(##M,leq,q,p) \<and> (q \<tturnstile> \<phi> env) \<and> (q \<tturnstile> \<psi> env))"
   unfolding forces_def
   using sats_is_leq_fm_auto assms sats_ren_forces_nand zero_in_M
   by simp
 
 lemma sats_forces_Neg :
   assumes "\<phi>\<in>formula" "env\<in>list(M)" "p\<in>M"
   shows "p \<tturnstile> \<cdot>\<not>\<phi>\<cdot> env \<longleftrightarrow>
-         (p\<in>P \<and> \<not>(\<exists>q\<in>M. q\<in>P \<and> is_leq(##M,leq,q,p) \<and> (q \<tturnstile> \<phi> env)))"
+         (p\<in>\<bbbP> \<and> \<not>(\<exists>q\<in>M. q\<in>\<bbbP> \<and> is_leq(##M,leq,q,p) \<and> (q \<tturnstile> \<phi> env)))"
   unfolding Neg_def using assms sats_forces_Nand
   by simp
 
 lemma sats_forces_Forall :
   assumes "\<phi>\<in>formula" "env\<in>list(M)" "p\<in>M"
-  shows "p \<tturnstile> (\<cdot>\<forall>\<phi>\<cdot>) env \<longleftrightarrow> p \<in> P \<and> (\<forall>x\<in>M. p \<tturnstile> \<phi> ([x] @ env))"
+  shows "p \<tturnstile> (\<cdot>\<forall>\<phi>\<cdot>) env \<longleftrightarrow> p \<in> \<bbbP> \<and> (\<forall>x\<in>M. p \<tturnstile> \<phi> ([x] @ env))"
   unfolding forces_def using assms sats_ren_forces_forall
   by simp
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forcing_Data.thy b/thys/Independence_CH/Forcing_Data.thy
--- a/thys/Independence_CH/Forcing_Data.thy
+++ b/thys/Independence_CH/Forcing_Data.thy
@@ -1,161 +1,161 @@
 section\<open>Transitive set models of ZF\<close>
 text\<open>This theory defines locales for countable transitive models of $\ZF$,
 and on top of that, one that includes a forcing notion. Weakened versions
 of both locales are included, that only assume finitely many replacement
 instances.\<close>
 
 theory Forcing_Data
   imports
     Forcing_Notions
     Cohen_Posets_Relative
     ZF_Trans_Interpretations
 begin
 
 no_notation Aleph (\<open>\<aleph>_\<close> [90] 90)
 
 subsection\<open>A forcing locale and generic filters\<close>
 
 text\<open>Ideally, countability should be separated from the assumption of this locale.
 The fact is that our present proofs of the “definition of forces” (and many
 consequences) and of the lemma for “forcing a value” of function
 unnecessarily depend on the countability of the ground model. \<close>
 
-locale forcing_data1 = forcing_notion + M_ctm1 + M_ZF_ground_trans +
-  assumes P_in_M:           "P \<in> M"
+locale forcing_data1 = forcing_notion + M_ctm1 +
+  assumes P_in_M:           "\<bbbP> \<in> M"
     and leq_in_M:         "leq \<in> M"
 
 locale forcing_data2 = forcing_data1 + M_ctm2_AC
 
 locale forcing_data3 = forcing_data2 + M_ctm3_AC
 
 context forcing_data1
 begin
 
-lemma P_sub_M : "P \<subseteq> M"
+lemma P_sub_M : "\<bbbP> \<subseteq> M"
   using transitivity P_in_M by auto
 
 definition
   M_generic :: "i\<Rightarrow>o" where
-  "M_generic(G) \<equiv> filter(G) \<and> (\<forall>D\<in>M. D\<subseteq>P \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
+  "M_generic(G) \<equiv> filter(G) \<and> (\<forall>D\<in>M. D\<subseteq>\<bbbP> \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
 
 declare iff_trans [trans]
 
 lemma M_generic_imp_filter[dest]: "M_generic(G) \<Longrightarrow> filter(G)"
   unfolding M_generic_def by blast
 
 lemma generic_filter_existence:
-  "p\<in>P \<Longrightarrow> \<exists>G. p\<in>G \<and> M_generic(G)"
+  "p\<in>\<bbbP> \<Longrightarrow> \<exists>G. p\<in>G \<and> M_generic(G)"
 proof -
-  assume "p\<in>P"
-  let ?D="\<lambda>n\<in>nat. (if (enum`n\<subseteq>P \<and> dense(enum`n))  then enum`n else P)"
-  have "\<forall>n\<in>nat. ?D`n \<in> Pow(P)"
+  assume "p\<in>\<bbbP>"
+  let ?D="\<lambda>n\<in>nat. (if (enum`n\<subseteq>\<bbbP> \<and> dense(enum`n))  then enum`n else \<bbbP>)"
+  have "\<forall>n\<in>nat. ?D`n \<in> Pow(\<bbbP>)"
     by auto
   then
-  have "?D:nat\<rightarrow>Pow(P)"
+  have "?D:nat\<rightarrow>Pow(\<bbbP>)"
     using lam_type by auto
   have "\<forall>n\<in>nat. dense(?D`n)"
   proof(intro ballI)
     fix n
     assume "n\<in>nat"
     then
-    have "dense(?D`n) \<longleftrightarrow> dense(if enum`n \<subseteq> P \<and> dense(enum`n) then enum`n else P)"
+    have "dense(?D`n) \<longleftrightarrow> dense(if enum`n \<subseteq> \<bbbP> \<and> dense(enum`n) then enum`n else \<bbbP>)"
       by simp
     also
-    have "... \<longleftrightarrow>  (\<not>(enum`n \<subseteq> P \<and> dense(enum`n)) \<longrightarrow> dense(P)) "
+    have "... \<longleftrightarrow>  (\<not>(enum`n \<subseteq> \<bbbP> \<and> dense(enum`n)) \<longrightarrow> dense(\<bbbP>)) "
       using split_if by simp
     finally
     show "dense(?D`n)"
       using P_dense \<open>n\<in>nat\<close> by auto
   qed
   with \<open>?D\<in>_\<close>
-  interpret cg: countable_generic P leq \<one> ?D
+  interpret cg: countable_generic \<bbbP> leq \<one> ?D
     by (unfold_locales, auto)
-  from \<open>p\<in>P\<close>
+  from \<open>p\<in>\<bbbP>\<close>
   obtain G where 1: "p\<in>G \<and> filter(G) \<and> (\<forall>n\<in>nat.(?D`n)\<inter>G\<noteq>0)"
     using cg.countable_rasiowa_sikorski[where M="\<lambda>_. M"]  P_sub_M
       M_countable[THEN bij_is_fun] M_countable[THEN bij_is_surj, THEN surj_range]
     unfolding cg.D_generic_def by blast
   then
-  have "(\<forall>D\<in>M. D\<subseteq>P \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
+  have "(\<forall>D\<in>M. D\<subseteq>\<bbbP> \<and> dense(D)\<longrightarrow>D\<inter>G\<noteq>0)"
   proof (intro ballI impI)
     fix D
-    assume "D\<in>M" and 2: "D \<subseteq> P \<and> dense(D) "
+    assume "D\<in>M" and 2: "D \<subseteq> \<bbbP> \<and> dense(D) "
     moreover
     have "\<forall>y\<in>M. \<exists>x\<in>nat. enum`x= y"
       using M_countable and  bij_is_surj unfolding surj_def by (simp)
     moreover from calculation
     obtain n where Eq10: "n\<in>nat \<and> enum`n = D"
       by auto
     moreover from calculation if_P
     have "?D`n = D"
       by simp
     moreover
     note 1
     ultimately
     show "D\<inter>G\<noteq>0"
       by auto
   qed
   with 1
   show ?thesis
     unfolding M_generic_def by auto
 qed
 
 lemma one_in_M: "\<one> \<in> M"
   using one_in_P P_in_M transitivity
   by simp
 
 declare P_in_M [simp,intro]
 declare one_in_M [simp,intro]
 declare leq_in_M [simp,intro]
 declare one_in_P [intro]
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 locale G_generic1 = forcing_data1 +
   fixes G :: "i"
   assumes generic : "M_generic(G)"
 begin
 
 lemma G_nonempty: "G\<noteq>0"
-  using generic subset_refl[of P] P_dense
+  using generic subset_refl[of \<bbbP>] P_dense
   unfolding M_generic_def
   by auto
 
-lemma M_genericD [dest]: "x\<in>G \<Longrightarrow> x\<in>P"
+lemma M_genericD [dest]: "x\<in>G \<Longrightarrow> x\<in>\<bbbP>"
   using generic
   by (blast dest:filterD)
 
-lemma M_generic_leqD [dest]: "p\<in>G \<Longrightarrow> q\<in>P \<Longrightarrow> p\<preceq>q \<Longrightarrow> q\<in>G"
+lemma M_generic_leqD [dest]: "p\<in>G \<Longrightarrow> q\<in>\<bbbP> \<Longrightarrow> p\<preceq>q \<Longrightarrow> q\<in>G"
   using generic
   by (blast dest:filter_leqD)
 
 lemma M_generic_compatD [dest]: "p\<in>G \<Longrightarrow> r\<in>G \<Longrightarrow> \<exists>q\<in>G. q\<preceq>p \<and> q\<preceq>r"
   using generic
   by (blast dest:low_bound_filter)
 
-lemma M_generic_denseD [dest]: "dense(D) \<Longrightarrow> D\<subseteq>P \<Longrightarrow> D\<in>M \<Longrightarrow> \<exists>q\<in>G. q\<in>D"
+lemma M_generic_denseD [dest]: "dense(D) \<Longrightarrow> D\<subseteq>\<bbbP> \<Longrightarrow> D\<in>M \<Longrightarrow> \<exists>q\<in>G. q\<in>D"
   using generic
   unfolding M_generic_def by blast
 
-lemma G_subset_P: "G\<subseteq>P"
+lemma G_subset_P: "G\<subseteq>\<bbbP>"
   using generic by auto
 
 lemma one_in_G : "\<one> \<in> G"
 proof -
   have "increasing(G)"
     using generic
     unfolding M_generic_def filter_def by simp
   then
   show ?thesis
     using G_nonempty one_max
     unfolding increasing_def by blast
 qed
 
 lemma G_subset_M: "G \<subseteq> M"
   using generic transitivity[OF _ P_in_M] by auto
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 locale G_generic1_AC = G_generic1 + M_ctm1_AC
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forcing_Main.thy b/thys/Independence_CH/Forcing_Main.thy
--- a/thys/Independence_CH/Forcing_Main.thy
+++ b/thys/Independence_CH/Forcing_Main.thy
@@ -1,170 +1,170 @@
-section\<open>The main theorem\<close>
+section\<open>The existence of generic extensions\<close>
 
 theory Forcing_Main
   imports
     Ordinals_In_MG
     Choice_Axiom
     Succession_Poset
 
 begin
 
 subsection\<open>The generic extension is countable\<close>
 
 lemma (in forcing_data1) surj_nat_MG : "\<exists>f. f \<in> surj(\<omega>,M[G])"
 proof -
   let ?f="\<lambda>n\<in>\<omega>. val(G,enum`n)"
   have "x \<in> \<omega> \<Longrightarrow> val(G, enum ` x)\<in> M[G]" for x
     using GenExtI bij_is_fun[OF M_countable]
     by simp
   then
   have "?f: \<omega> \<rightarrow> M[G]"
     using lam_type[of \<omega> "\<lambda>n. val(G,enum`n)" "\<lambda>_.M[G]"] by simp
   moreover
   have "\<exists>n\<in>\<omega>. ?f`n = x" if "x\<in>M[G]" for x
     using that GenExt_iff[of _ G] bij_is_surj[OF M_countable]
     unfolding surj_def by auto
   ultimately
   show ?thesis
     unfolding surj_def by blast
 qed
 
 lemma (in G_generic1) MG_eqpoll_nat: "M[G] \<approx> \<omega>"
 proof -
   obtain f where "f \<in> surj(\<omega>,M[G])"
     using surj_nat_MG by blast
   then
   have "M[G] \<lesssim> \<omega>"
     using well_ord_surj_imp_lepoll well_ord_Memrel[of \<omega>] by simp
   moreover
   have "\<omega> \<lesssim> M[G]"
     using ext.nat_into_M subset_imp_lepoll by (auto del:lepollI)
   ultimately
   show ?thesis
     using eqpollI by simp
 qed
 
 subsection\<open>Extensions of ctms of fragments of $\ZFC$\<close>
 
 context G_generic1
 begin
 
 lemma sats_ground_repl_fm_imp_sats_ZF_replacement_fm:
   assumes
     "\<phi>\<in>formula" "M, [] \<Turnstile> \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot>"
   shows
     "M[G], [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>"
   using assms sats_ZF_replacement_fm_iff
   by (auto simp:replacement_assm_def ground_replacement_assm_def
       intro:strong_replacement_in_MG[simplified])
 
 lemma satT_ground_repl_fm_imp_satT_ZF_replacement_fm:
   assumes
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "M[G] \<Turnstile> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}"
   using assms sats_ground_repl_fm_imp_sats_ZF_replacement_fm
   by auto
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 theorem extensions_of_ctms:
   assumes
     "M \<approx> \<omega>" "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead}"
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>}"
 proof -
   from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> _\<close> \<open>Transset(M)\<close>
   interpret M_ZF_ground_trans M
     using M_satT_imp_M_ZF_ground_trans
     by simp
   from \<open>M \<approx> \<omega>\<close>
   obtain enum where "enum \<in> bij(\<omega>,M)"
     using eqpoll_sym unfolding eqpoll_def by blast
   then
   interpret M_ctm1 M enum by unfold_locales
   interpret forcing_data1 "2\<^bsup><\<omega>\<^esup>" seqle 0 M enum
     using nat_into_M seqspace_closed seqle_in_M
     by unfold_locales simp
   obtain G where "M_generic(G)" "M \<noteq> M[G]"
     using cohen_extension_is_proper
     by blast
   text\<open>Recall that \<^term>\<open>M[G]\<close> denotes the generic extension
   of \<^term>\<open>M\<close> using the poset of sequences \<^term>\<open>2\<^bsup><\<omega>\<^esup>\<close>.\<close>
   then
   interpret G_generic1 "2\<^bsup><\<omega>\<^esup>" seqle 0 _ enum G by unfold_locales
   interpret MG: M_Z_basic "M[G]"
     using generic pairing_in_MG
       Union_MG  extensionality_in_MG power_in_MG
       foundation_in_MG replacement_assm_MG
       separation_in_MG infinity_in_MG replacement_ax1
     by unfold_locales simp
   have "M, []\<Turnstile> \<cdot>AC\<cdot> \<Longrightarrow> M[G], [] \<Turnstile> \<cdot>AC\<cdot>"
   proof -
     assume "M, [] \<Turnstile> \<cdot>AC\<cdot>"
     then
     have "choice_ax(##M)"
       unfolding ZF_choice_fm_def using ZF_choice_auto by simp
     then
     have "choice_ax(##M[G])" using choice_in_MG by simp
     then
     show "M[G], [] \<Turnstile> \<cdot>AC\<cdot>"
       using ZF_choice_auto sats_ZFC_iff_sats_ZF_AC
       unfolding ZF_choice_fm_def by simp
   qed
   moreover
   note \<open>M \<noteq> M[G]\<close> \<open>M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}\<close> \<open>\<Phi> \<subseteq> formula\<close>
   moreover
   have "Transset(M[G])" using Transset_MG .
   moreover
   have "M \<subseteq> M[G]" using M_subset_MG[OF one_in_G] generic by simp
   ultimately
   show ?thesis
     using Ord_MG_iff MG_eqpoll_nat ext.M_satT_Zermelo_fms
       satT_ground_repl_fm_imp_satT_ZF_replacement_fm[of \<Phi>]
     by (rule_tac x="M[G]" in exI, auto)
 qed
 
 lemma ZF_replacement_overhead_sub_ZF: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<subseteq> ZF"
   using instances1_fms_type instances_ground_fms_type
   unfolding overhead_def ZF_def ZF_schemes_def by auto
 
 theorem extensions_of_ctms_ZF:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZF"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZF \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC)"
 proof -
   from assms
   have "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> M\<noteq>N \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)) \<and>
       ((M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>) \<and> N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}"
     using extensions_of_ctms[of M formula] satT_ZF_imp_satT_Z[of M]
       satT_mono[OF _ ground_repl_fm_sub_ZF, of M]
       satT_mono[OF _ ZF_replacement_overhead_sub_ZF, of M]
     by (auto simp: satT_Un_iff)
   then
   obtain N where "N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}" "M \<subseteq> N" "N \<approx> \<omega>" "Transset(N)"
     "M \<noteq> N" "(\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     "(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>"
     by blast
   moreover from \<open>N \<Turnstile> \<cdot>Z\<cdot> \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> formula}\<close>
   have "N \<Turnstile> ZF"
     using satT_Z_ZF_replacement_imp_satT_ZF by auto
   moreover from this and \<open>(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N, [] \<Turnstile> \<cdot>AC\<cdot>\<close>
   have "(M, []\<Turnstile> \<cdot>AC\<cdot>) \<longrightarrow> N \<Turnstile> ZFC"
     using sats_ZFC_iff_sats_ZF_AC by simp
   ultimately
   show ?thesis
     by auto
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Forcing_Notions.thy b/thys/Independence_CH/Forcing_Notions.thy
--- a/thys/Independence_CH/Forcing_Notions.thy
+++ b/thys/Independence_CH/Forcing_Notions.thy
@@ -1,432 +1,430 @@
 section\<open>Forcing notions\<close>
 text\<open>This theory defines a locale for forcing notions, that is,
  preorders with a distinguished maximum element.\<close>
 
 theory Forcing_Notions
   imports
     "ZF-Constructible.Relative"
     "Delta_System_Lemma.ZF_Library"
 begin
 
 hide_const (open) Order.pred
 
 subsection\<open>Basic concepts\<close>
 text\<open>We say that two elements $p,q$ are
   \<^emph>\<open>compatible\<close> if they have a lower bound in $P$\<close>
 definition compat_in :: "i\<Rightarrow>i\<Rightarrow>i\<Rightarrow>i\<Rightarrow>o" where
   "compat_in(A,r,p,q) \<equiv> \<exists>d\<in>A . \<langle>d,p\<rangle>\<in>r \<and> \<langle>d,q\<rangle>\<in>r"
 
 lemma compat_inI :
   "\<lbrakk> d\<in>A ; \<langle>d,p\<rangle>\<in>r ; \<langle>d,g\<rangle>\<in>r \<rbrakk> \<Longrightarrow> compat_in(A,r,p,g)"
   by (auto simp add: compat_in_def)
 
 lemma refl_compat:
   "\<lbrakk> refl(A,r) ; \<langle>p,q\<rangle> \<in> r | p=q | \<langle>q,p\<rangle> \<in> r ; p\<in>A ; q\<in>A\<rbrakk> \<Longrightarrow> compat_in(A,r,p,q)"
   by (auto simp add: refl_def compat_inI)
 
 lemma  chain_compat:
   "refl(A,r) \<Longrightarrow> linear(A,r) \<Longrightarrow>  (\<forall>p\<in>A.\<forall>q\<in>A. compat_in(A,r,p,q))"
   by (simp add: refl_compat linear_def)
 
 lemma subset_fun_image: "f:N\<rightarrow>P \<Longrightarrow> f``N\<subseteq>P"
   by (auto simp add: image_fun apply_funtype)
 
 lemma refl_monot_domain: "refl(B,r) \<Longrightarrow> A\<subseteq>B \<Longrightarrow> refl(A,r)"
   unfolding refl_def by blast
 
 locale forcing_notion =
-  fixes P leq one
-  assumes one_in_P:       "one \<in> P"
-    and leq_preord:       "preorder_on(P,leq)"
-    and one_max:          "\<forall>p\<in>P. \<langle>p,one\<rangle>\<in>leq"
+  fixes P (\<open>\<bbbP>\<close>) and leq and one (\<open>\<one>\<close>)
+  assumes one_in_P:       "\<one> \<in> \<bbbP>"
+    and leq_preord:       "preorder_on(\<bbbP>,leq)"
+    and one_max:          "\<forall>p\<in>\<bbbP>. \<langle>p,\<one>\<rangle>\<in>leq"
 begin
 
-notation one (\<open>\<one>\<close>)
-
 abbreviation Leq :: "[i, i] \<Rightarrow> o"  (infixl "\<preceq>" 50)
   where "x \<preceq> y \<equiv> \<langle>x,y\<rangle>\<in>leq"
 
 lemma refl_leq:
-  "r\<in>P \<Longrightarrow> r\<preceq>r"
+  "r\<in>\<bbbP> \<Longrightarrow> r\<preceq>r"
   using leq_preord unfolding preorder_on_def refl_def by simp
 
-text\<open>A set $D$ is \<^emph>\<open>dense\<close> if every element $p\in P$ has a lower
+text\<open>A set $D$ is \<^emph>\<open>dense\<close> if every element $p\in \mathbb{P}$ has a lower
 bound in $D$.\<close>
 definition
   dense :: "i\<Rightarrow>o" where
-  "dense(D) \<equiv> \<forall>p\<in>P. \<exists>d\<in>D . d\<preceq>p"
+  "dense(D) \<equiv> \<forall>p\<in>\<bbbP>. \<exists>d\<in>D . d\<preceq>p"
 
 text\<open>There is also a weaker definition which asks for
 a lower bound in $D$ only for the elements below some fixed
 element $q$.\<close>
 definition
   dense_below :: "i\<Rightarrow>i\<Rightarrow>o" where
-  "dense_below(D,q) \<equiv> \<forall>p\<in>P. p\<preceq>q \<longrightarrow> (\<exists>d\<in>D. d\<in>P \<and> d\<preceq>p)"
+  "dense_below(D,q) \<equiv> \<forall>p\<in>\<bbbP>. p\<preceq>q \<longrightarrow> (\<exists>d\<in>D. d\<in>\<bbbP> \<and> d\<preceq>p)"
 
-lemma P_dense: "dense(P)"
+lemma P_dense: "dense(\<bbbP>)"
   by (insert leq_preord, auto simp add: preorder_on_def refl_def dense_def)
 
 definition
   increasing :: "i\<Rightarrow>o" where
-  "increasing(F) \<equiv> \<forall>x\<in>F. \<forall> p \<in> P . x\<preceq>p \<longrightarrow> p\<in>F"
+  "increasing(F) \<equiv> \<forall>x\<in>F. \<forall> p \<in> \<bbbP> . x\<preceq>p \<longrightarrow> p\<in>F"
 
 definition
   compat :: "i\<Rightarrow>i\<Rightarrow>o" where
-  "compat(p,q) \<equiv> compat_in(P,leq,p,q)"
+  "compat(p,q) \<equiv> compat_in(\<bbbP>,leq,p,q)"
 
-lemma leq_transD:  "a\<preceq>b \<Longrightarrow> b\<preceq>c \<Longrightarrow> a \<in> P\<Longrightarrow> b \<in> P\<Longrightarrow> c \<in> P\<Longrightarrow> a\<preceq>c"
+lemma leq_transD:  "a\<preceq>b \<Longrightarrow> b\<preceq>c \<Longrightarrow> a \<in> \<bbbP>\<Longrightarrow> b \<in> \<bbbP>\<Longrightarrow> c \<in> \<bbbP>\<Longrightarrow> a\<preceq>c"
   using leq_preord trans_onD unfolding preorder_on_def by blast
 
-lemma leq_transD':  "A\<subseteq>P \<Longrightarrow> a\<preceq>b \<Longrightarrow> b\<preceq>c \<Longrightarrow> a \<in> A \<Longrightarrow> b \<in> P\<Longrightarrow> c \<in> P\<Longrightarrow> a\<preceq>c"
+lemma leq_transD':  "A\<subseteq>\<bbbP> \<Longrightarrow> a\<preceq>b \<Longrightarrow> b\<preceq>c \<Longrightarrow> a \<in> A \<Longrightarrow> b \<in> \<bbbP>\<Longrightarrow> c \<in> \<bbbP>\<Longrightarrow> a\<preceq>c"
   using leq_preord trans_onD subsetD unfolding preorder_on_def by blast
 
-lemma compatD[dest!]: "compat(p,q) \<Longrightarrow> \<exists>d\<in>P. d\<preceq>p \<and> d\<preceq>q"
+lemma compatD[dest!]: "compat(p,q) \<Longrightarrow> \<exists>d\<in>\<bbbP>. d\<preceq>p \<and> d\<preceq>q"
   unfolding compat_def compat_in_def .
 
 abbreviation Incompatible :: "[i, i] \<Rightarrow> o"  (infixl "\<bottom>" 50)
   where "p \<bottom> q \<equiv> \<not> compat(p,q)"
 
-lemma compatI[intro!]: "d\<in>P \<Longrightarrow> d\<preceq>p \<Longrightarrow> d\<preceq>q \<Longrightarrow> compat(p,q)"
+lemma compatI[intro!]: "d\<in>\<bbbP> \<Longrightarrow> d\<preceq>p \<Longrightarrow> d\<preceq>q \<Longrightarrow> compat(p,q)"
   unfolding compat_def compat_in_def by blast
 
-lemma Incompatible_imp_not_eq: "\<lbrakk> p \<bottom> q; p\<in>P; q\<in>P \<rbrakk>\<Longrightarrow> p \<noteq> q"
+lemma Incompatible_imp_not_eq: "\<lbrakk> p \<bottom> q; p\<in>\<bbbP>; q\<in>\<bbbP> \<rbrakk>\<Longrightarrow> p \<noteq> q"
   using refl_leq by blast
 
-lemma denseD [dest]: "dense(D) \<Longrightarrow> p\<in>P \<Longrightarrow>  \<exists>d\<in>D. d\<preceq> p"
+lemma denseD [dest]: "dense(D) \<Longrightarrow> p\<in>\<bbbP> \<Longrightarrow>  \<exists>d\<in>D. d\<preceq> p"
   unfolding dense_def by blast
 
-lemma denseI [intro!]: "\<lbrakk> \<And>p. p\<in>P \<Longrightarrow> \<exists>d\<in>D. d\<preceq> p \<rbrakk> \<Longrightarrow> dense(D)"
+lemma denseI [intro!]: "\<lbrakk> \<And>p. p\<in>\<bbbP> \<Longrightarrow> \<exists>d\<in>D. d\<preceq> p \<rbrakk> \<Longrightarrow> dense(D)"
   unfolding dense_def by blast
 
 lemma dense_belowD [dest]:
-  assumes "dense_below(D,p)" "q\<in>P" "q\<preceq>p"
-  shows "\<exists>d\<in>D. d\<in>P \<and> d\<preceq>q"
+  assumes "dense_below(D,p)" "q\<in>\<bbbP>" "q\<preceq>p"
+  shows "\<exists>d\<in>D. d\<in>\<bbbP> \<and> d\<preceq>q"
   using assms unfolding dense_below_def by simp
 
 lemma dense_belowI [intro!]:
-  assumes "\<And>q. q\<in>P \<Longrightarrow> q\<preceq>p \<Longrightarrow> \<exists>d\<in>D. d\<in>P \<and> d\<preceq>q"
+  assumes "\<And>q. q\<in>\<bbbP> \<Longrightarrow> q\<preceq>p \<Longrightarrow> \<exists>d\<in>D. d\<in>\<bbbP> \<and> d\<preceq>q"
   shows "dense_below(D,p)"
   using assms unfolding dense_below_def by simp
 
-lemma dense_below_cong: "p\<in>P \<Longrightarrow> D = D' \<Longrightarrow> dense_below(D,p) \<longleftrightarrow> dense_below(D',p)"
+lemma dense_below_cong: "p\<in>\<bbbP> \<Longrightarrow> D = D' \<Longrightarrow> dense_below(D,p) \<longleftrightarrow> dense_below(D',p)"
   by blast
 
-lemma dense_below_cong': "p\<in>P \<Longrightarrow> \<lbrakk>\<And>x. x\<in>P \<Longrightarrow> Q(x) \<longleftrightarrow> Q'(x)\<rbrakk> \<Longrightarrow>
-           dense_below({q\<in>P. Q(q)},p) \<longleftrightarrow> dense_below({q\<in>P. Q'(q)},p)"
+lemma dense_below_cong': "p\<in>\<bbbP> \<Longrightarrow> \<lbrakk>\<And>x. x\<in>\<bbbP> \<Longrightarrow> Q(x) \<longleftrightarrow> Q'(x)\<rbrakk> \<Longrightarrow>
+           dense_below({q\<in>\<bbbP>. Q(q)},p) \<longleftrightarrow> dense_below({q\<in>\<bbbP>. Q'(q)},p)"
   by blast
 
-lemma dense_below_mono: "p\<in>P \<Longrightarrow> D \<subseteq> D' \<Longrightarrow> dense_below(D,p) \<Longrightarrow> dense_below(D',p)"
+lemma dense_below_mono: "p\<in>\<bbbP> \<Longrightarrow> D \<subseteq> D' \<Longrightarrow> dense_below(D,p) \<Longrightarrow> dense_below(D',p)"
   by blast
 
 lemma dense_below_under:
-  assumes "dense_below(D,p)" "p\<in>P" "q\<in>P" "q\<preceq>p"
+  assumes "dense_below(D,p)" "p\<in>\<bbbP>" "q\<in>\<bbbP>" "q\<preceq>p"
   shows "dense_below(D,q)"
   using assms leq_transD by blast
 
 lemma ideal_dense_below:
-  assumes "\<And>q. q\<in>P \<Longrightarrow> q\<preceq>p \<Longrightarrow> q\<in>D"
+  assumes "\<And>q. q\<in>\<bbbP> \<Longrightarrow> q\<preceq>p \<Longrightarrow> q\<in>D"
   shows "dense_below(D,p)"
   using assms refl_leq by blast
 
 lemma dense_below_dense_below:
-  assumes "dense_below({q\<in>P. dense_below(D,q)},p)" "p\<in>P"
+  assumes "dense_below({q\<in>\<bbbP>. dense_below(D,q)},p)" "p\<in>\<bbbP>"
   shows "dense_below(D,p)"
   using assms leq_transD refl_leq  by blast
 
 text\<open>A filter is an increasing set $G$ with all its elements
 being compatible in $G$.\<close>
 definition
   filter :: "i\<Rightarrow>o" where
-  "filter(G) \<equiv> G\<subseteq>P \<and> increasing(G) \<and> (\<forall>p\<in>G. \<forall>q\<in>G. compat_in(G,leq,p,q))"
+  "filter(G) \<equiv> G\<subseteq>\<bbbP> \<and> increasing(G) \<and> (\<forall>p\<in>G. \<forall>q\<in>G. compat_in(G,leq,p,q))"
 
-lemma filterD : "filter(G) \<Longrightarrow> x \<in> G \<Longrightarrow> x \<in> P"
+lemma filterD : "filter(G) \<Longrightarrow> x \<in> G \<Longrightarrow> x \<in> \<bbbP>"
   by (auto simp add : subsetD filter_def)
 
-lemma filter_subset_notion[dest]: "filter(G) \<Longrightarrow> G \<subseteq> P"
+lemma filter_subset_notion[dest]: "filter(G) \<Longrightarrow> G \<subseteq> \<bbbP>"
   by (auto dest:filterD)
 
-lemma filter_leqD : "filter(G) \<Longrightarrow> x \<in> G \<Longrightarrow> y \<in> P \<Longrightarrow> x\<preceq>y \<Longrightarrow> y \<in> G"
+lemma filter_leqD : "filter(G) \<Longrightarrow> x \<in> G \<Longrightarrow> y \<in> \<bbbP> \<Longrightarrow> x\<preceq>y \<Longrightarrow> y \<in> G"
   by (simp add: filter_def increasing_def)
 
 lemma filter_imp_compat: "filter(G) \<Longrightarrow> p\<in>G \<Longrightarrow> q\<in>G \<Longrightarrow> compat(p,q)"
   unfolding filter_def compat_in_def compat_def by blast
 
 lemma low_bound_filter: \<comment> \<open>says the compatibility is attained inside G\<close>
   assumes "filter(G)" and "p\<in>G" and "q\<in>G"
   shows "\<exists>r\<in>G. r\<preceq>p \<and> r\<preceq>q"
   using assms
   unfolding compat_in_def filter_def by blast
 
 text\<open>We finally introduce the upward closure of a set
 and prove that the closure of $A$ is a filter if its elements are
 compatible in $A$.\<close>
 definition
   upclosure :: "i\<Rightarrow>i" where
-  "upclosure(A) \<equiv> {p\<in>P.\<exists>a\<in>A. a\<preceq>p}"
+  "upclosure(A) \<equiv> {p\<in>\<bbbP>.\<exists>a\<in>A. a\<preceq>p}"
 
-lemma  upclosureI [intro] : "p\<in>P \<Longrightarrow> a\<in>A \<Longrightarrow> a\<preceq>p \<Longrightarrow> p\<in>upclosure(A)"
+lemma  upclosureI [intro] : "p\<in>\<bbbP> \<Longrightarrow> a\<in>A \<Longrightarrow> a\<preceq>p \<Longrightarrow> p\<in>upclosure(A)"
   by (simp add:upclosure_def, auto)
 
 lemma  upclosureE [elim] :
-  "p\<in>upclosure(A) \<Longrightarrow> (\<And>x a. x\<in>P \<Longrightarrow> a\<in>A \<Longrightarrow> a\<preceq>x \<Longrightarrow> R) \<Longrightarrow> R"
+  "p\<in>upclosure(A) \<Longrightarrow> (\<And>x a. x\<in>\<bbbP> \<Longrightarrow> a\<in>A \<Longrightarrow> a\<preceq>x \<Longrightarrow> R) \<Longrightarrow> R"
   by (auto simp add:upclosure_def)
 
 lemma  upclosureD [dest] :
-  "p\<in>upclosure(A) \<Longrightarrow> \<exists>a\<in>A.(a\<preceq>p) \<and> p\<in>P"
+  "p\<in>upclosure(A) \<Longrightarrow> \<exists>a\<in>A.(a\<preceq>p) \<and> p\<in>\<bbbP>"
   by (simp add:upclosure_def)
 
 lemma upclosure_increasing :
-  assumes "A\<subseteq>P"
+  assumes "A\<subseteq>\<bbbP>"
   shows "increasing(upclosure(A))"
   unfolding increasing_def upclosure_def
-  using leq_transD'[OF \<open>A\<subseteq>P\<close>] by auto
+  using leq_transD'[OF \<open>A\<subseteq>\<bbbP>\<close>] by auto
 
-lemma  upclosure_in_P: "A \<subseteq> P \<Longrightarrow> upclosure(A) \<subseteq> P"
+lemma  upclosure_in_P: "A \<subseteq> \<bbbP> \<Longrightarrow> upclosure(A) \<subseteq> \<bbbP>"
   using subsetI upclosure_def by simp
 
-lemma  A_sub_upclosure: "A \<subseteq> P \<Longrightarrow> A\<subseteq>upclosure(A)"
+lemma  A_sub_upclosure: "A \<subseteq> \<bbbP> \<Longrightarrow> A\<subseteq>upclosure(A)"
   using subsetI leq_preord
   unfolding upclosure_def preorder_on_def refl_def by auto
 
-lemma  elem_upclosure: "A\<subseteq>P \<Longrightarrow> x\<in>A  \<Longrightarrow> x\<in>upclosure(A)"
+lemma  elem_upclosure: "A\<subseteq>\<bbbP> \<Longrightarrow> x\<in>A  \<Longrightarrow> x\<in>upclosure(A)"
   by (blast dest:A_sub_upclosure)
 
 lemma  closure_compat_filter:
-  assumes "A\<subseteq>P" "(\<forall>p\<in>A.\<forall>q\<in>A. compat_in(A,leq,p,q))"
+  assumes "A\<subseteq>\<bbbP>" "(\<forall>p\<in>A.\<forall>q\<in>A. compat_in(A,leq,p,q))"
   shows "filter(upclosure(A))"
   unfolding filter_def
 proof(auto)
   show "increasing(upclosure(A))"
     using assms upclosure_increasing by simp
 next
   let ?UA="upclosure(A)"
   show "compat_in(upclosure(A), leq, p, q)" if "p\<in>?UA" "q\<in>?UA" for p q
   proof -
     from that
-    obtain a b where 1:"a\<in>A" "b\<in>A" "a\<preceq>p" "b\<preceq>q" "p\<in>P" "q\<in>P"
+    obtain a b where 1:"a\<in>A" "b\<in>A" "a\<preceq>p" "b\<preceq>q" "p\<in>\<bbbP>" "q\<in>\<bbbP>"
       using upclosureD[OF \<open>p\<in>?UA\<close>] upclosureD[OF \<open>q\<in>?UA\<close>] by auto
     with assms(2)
     obtain d where "d\<in>A" "d\<preceq>a" "d\<preceq>b"
       unfolding compat_in_def by auto
     with 1
     have "d\<preceq>p" "d\<preceq>q" "d\<in>?UA"
-      using A_sub_upclosure[THEN subsetD] \<open>A\<subseteq>P\<close>
+      using A_sub_upclosure[THEN subsetD] \<open>A\<subseteq>\<bbbP>\<close>
         leq_transD'[of A d a] leq_transD'[of A d b] by auto
     then
     show ?thesis unfolding compat_in_def by auto
   qed
 qed
 
-lemma  aux_RS1:  "f \<in> N \<rightarrow> P \<Longrightarrow> n\<in>N \<Longrightarrow> f`n \<in> upclosure(f ``N)"
+lemma  aux_RS1:  "f \<in> N \<rightarrow> \<bbbP> \<Longrightarrow> n\<in>N \<Longrightarrow> f`n \<in> upclosure(f ``N)"
   using elem_upclosure[OF subset_fun_image] image_fun
   by (simp, blast)
 
 lemma decr_succ_decr:
-  assumes "f \<in> nat \<rightarrow> P" "preorder_on(P,leq)"
+  assumes "f \<in> nat \<rightarrow> \<bbbP>" "preorder_on(\<bbbP>,leq)"
     "\<forall>n\<in>nat.  \<langle>f ` succ(n), f ` n\<rangle> \<in> leq"
     "m\<in>nat"
   shows "n\<in>nat \<Longrightarrow> n\<le>m \<Longrightarrow> \<langle>f ` m, f ` n\<rangle> \<in> leq"
   using \<open>m\<in>_\<close>
 proof(induct m)
   case 0
   then show ?case using assms refl_leq by simp
 next
   case (succ x)
   then
-  have 1:"f`succ(x) \<preceq> f`x" "f`n\<in>P" "f`x\<in>P" "f`succ(x)\<in>P"
+  have 1:"f`succ(x) \<preceq> f`x" "f`n\<in>\<bbbP>" "f`x\<in>\<bbbP>" "f`succ(x)\<in>\<bbbP>"
     using assms by simp_all
   consider (lt) "n<succ(x)" | (eq) "n=succ(x)"
     using succ le_succ_iff by auto
   then
   show ?case
   proof(cases)
     case lt
     with 1 show ?thesis using leI succ leq_transD by auto
   next
     case eq
     with 1 show ?thesis using refl_leq by simp
   qed
 qed
 
 lemma decr_seq_linear:
-  assumes "refl(P,leq)" "f \<in> nat \<rightarrow> P"
+  assumes "refl(\<bbbP>,leq)" "f \<in> nat \<rightarrow> \<bbbP>"
     "\<forall>n\<in>nat.  \<langle>f ` succ(n), f ` n\<rangle> \<in> leq"
-    "trans[P](leq)"
+    "trans[\<bbbP>](leq)"
   shows "linear(f `` nat, leq)"
 proof -
-  have "preorder_on(P,leq)"
+  have "preorder_on(\<bbbP>,leq)"
     unfolding preorder_on_def using assms by simp
   {
     fix n m
     assume "n\<in>nat" "m\<in>nat"
     then
     have "f`m \<preceq> f`n \<or> f`n \<preceq> f`m"
     proof(cases "m\<le>n")
       case True
       with \<open>n\<in>_\<close> \<open>m\<in>_\<close>
       show ?thesis
-        using decr_succ_decr[of f n m] assms leI \<open>preorder_on(P,leq)\<close> by simp
+        using decr_succ_decr[of f n m] assms leI \<open>preorder_on(\<bbbP>,leq)\<close> by simp
     next
       case False
       with \<open>n\<in>_\<close> \<open>m\<in>_\<close>
       show ?thesis
-        using decr_succ_decr[of f m n] assms leI not_le_iff_lt \<open>preorder_on(P,leq)\<close> by simp
+        using decr_succ_decr[of f m n] assms leI not_le_iff_lt \<open>preorder_on(\<bbbP>,leq)\<close> by simp
     qed
   }
   then
   show ?thesis
     unfolding linear_def using ball_image_simp assms by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>forcing_notion\<close>\<close>
 
 subsection\<open>Towards Rasiowa-Sikorski Lemma (RSL)\<close>
 locale countable_generic = forcing_notion +
   fixes \<D>
-  assumes countable_subs_of_P:  "\<D> \<in> nat\<rightarrow>Pow(P)"
+  assumes countable_subs_of_P:  "\<D> \<in> nat\<rightarrow>Pow(\<bbbP>)"
     and     seq_of_denses:        "\<forall>n \<in> nat. dense(\<D>`n)"
 
 begin
 
 definition
   D_generic :: "i\<Rightarrow>o" where
   "D_generic(G) \<equiv> filter(G) \<and> (\<forall>n\<in>nat.(\<D>`n)\<inter>G\<noteq>0)"
 
 text\<open>The next lemma identifies a sufficient condition for obtaining
 RSL.\<close>
 lemma RS_sequence_imp_rasiowa_sikorski:
   assumes
-    "p\<in>P" "f : nat\<rightarrow>P" "f ` 0 = p"
+    "p\<in>\<bbbP>" "f : nat\<rightarrow>\<bbbP>" "f ` 0 = p"
     "\<And>n. n\<in>nat \<Longrightarrow> f ` succ(n)\<preceq> f ` n \<and> f ` succ(n) \<in> \<D> ` n"
   shows
     "\<exists>G. p\<in>G \<and> D_generic(G)"
 proof -
   note assms
   moreover from this
-  have "f``nat  \<subseteq> P"
+  have "f``nat  \<subseteq> \<bbbP>"
     by (simp add:subset_fun_image)
   moreover from calculation
-  have "refl(f``nat, leq) \<and> trans[P](leq)"
+  have "refl(f``nat, leq) \<and> trans[\<bbbP>](leq)"
     using leq_preord unfolding preorder_on_def by (blast intro:refl_monot_domain)
   moreover from calculation
   have "\<forall>n\<in>nat.  f ` succ(n)\<preceq> f ` n" by (simp)
   moreover from calculation
   have "linear(f``nat, leq)"
     using leq_preord and decr_seq_linear unfolding preorder_on_def by (blast)
   moreover from calculation
   have "(\<forall>p\<in>f``nat.\<forall>q\<in>f``nat. compat_in(f``nat,leq,p,q))"
     using chain_compat by (auto)
   ultimately
   have "filter(upclosure(f``nat))" (is "filter(?G)")
     using closure_compat_filter by simp
   moreover
   have "\<forall>n\<in>nat. \<D> ` n \<inter> ?G \<noteq> 0"
   proof
     fix n
     assume "n\<in>nat"
     with assms
     have "f`succ(n) \<in> ?G \<and> f`succ(n) \<in> \<D> ` n"
       using aux_RS1 by simp
     then
     show "\<D> ` n \<inter> ?G \<noteq> 0"  by blast
   qed
   moreover from assms
   have "p \<in> ?G"
     using aux_RS1 by auto
   ultimately
   show ?thesis unfolding D_generic_def by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>countable_generic\<close>\<close>
 
 text\<open>Now, the following recursive definition will fulfill the
 requirements of lemma \<^term>\<open>RS_sequence_imp_rasiowa_sikorski\<close> \<close>
 
 consts RS_seq :: "[i,i,i,i,i,i] \<Rightarrow> i"
 primrec
   "RS_seq(0,P,leq,p,enum,\<D>) = p"
   "RS_seq(succ(n),P,leq,p,enum,\<D>) =
     enum`(\<mu> m. \<langle>enum`m, RS_seq(n,P,leq,p,enum,\<D>)\<rangle> \<in> leq \<and> enum`m \<in> \<D> ` n)"
 
 context countable_generic
 begin
 
 lemma countable_RS_sequence_aux:
   fixes p enum
-  defines "f(n) \<equiv> RS_seq(n,P,leq,p,enum,\<D>)"
+  defines "f(n) \<equiv> RS_seq(n,\<bbbP>,leq,p,enum,\<D>)"
     and   "Q(q,k,m) \<equiv> enum`m\<preceq> q \<and> enum`m \<in> \<D> ` k"
-  assumes "n\<in>nat" "p\<in>P" "P \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
-    "\<And>x k. x\<in>P \<Longrightarrow> k\<in>nat \<Longrightarrow>  \<exists>q\<in>P. q\<preceq> x \<and> q \<in> \<D> ` k"
+  assumes "n\<in>nat" "p\<in>\<bbbP>" "\<bbbP> \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
+    "\<And>x k. x\<in>\<bbbP> \<Longrightarrow> k\<in>nat \<Longrightarrow>  \<exists>q\<in>\<bbbP>. q\<preceq> x \<and> q \<in> \<D> ` k"
   shows
-    "f(succ(n)) \<in> P \<and> f(succ(n))\<preceq> f(n) \<and> f(succ(n)) \<in> \<D> ` n"
+    "f(succ(n)) \<in> \<bbbP> \<and> f(succ(n))\<preceq> f(n) \<and> f(succ(n)) \<in> \<D> ` n"
   using \<open>n\<in>nat\<close>
 proof (induct)
   case 0
   from assms
-  obtain q where "q\<in>P" "q\<preceq> p" "q \<in> \<D> ` 0" by blast
-  moreover from this and \<open>P \<subseteq> range(enum)\<close>
+  obtain q where "q\<in>\<bbbP>" "q\<preceq> p" "q \<in> \<D> ` 0" by blast
+  moreover from this and \<open>\<bbbP> \<subseteq> range(enum)\<close>
   obtain m where "m\<in>nat" "enum`m = q"
     using Pi_rangeD[OF \<open>enum:nat\<rightarrow>M\<close>] by blast
   moreover
-  have "\<D>`0 \<subseteq> P"
+  have "\<D>`0 \<subseteq> \<bbbP>"
     using apply_funtype[OF countable_subs_of_P] by simp
-  moreover note \<open>p\<in>P\<close>
+  moreover note \<open>p\<in>\<bbbP>\<close>
   ultimately
   show ?case
     using LeastI[of "Q(p,0)" m] unfolding Q_def f_def by auto
 next
   case (succ n)
   with assms
-  obtain q where "q\<in>P" "q\<preceq> f(succ(n))" "q \<in> \<D> ` succ(n)" by blast
-  moreover from this and \<open>P \<subseteq> range(enum)\<close>
+  obtain q where "q\<in>\<bbbP>" "q\<preceq> f(succ(n))" "q \<in> \<D> ` succ(n)" by blast
+  moreover from this and \<open>\<bbbP> \<subseteq> range(enum)\<close>
   obtain m where "m\<in>nat" "enum`m\<preceq> f(succ(n))" "enum`m \<in> \<D> ` succ(n)"
     using Pi_rangeD[OF \<open>enum:nat\<rightarrow>M\<close>] by blast
   moreover note succ
   moreover from calculation
-  have "\<D>`succ(n) \<subseteq> P"
+  have "\<D>`succ(n) \<subseteq> \<bbbP>"
     using apply_funtype[OF countable_subs_of_P] by auto
   ultimately
   show ?case
     using LeastI[of "Q(f(succ(n)),succ(n))" m] unfolding Q_def f_def by auto
 qed
 
 lemma countable_RS_sequence:
   fixes p enum
-  defines "f \<equiv> \<lambda>n\<in>nat. RS_seq(n,P,leq,p,enum,\<D>)"
+  defines "f \<equiv> \<lambda>n\<in>nat. RS_seq(n,\<bbbP>,leq,p,enum,\<D>)"
     and   "Q(q,k,m) \<equiv> enum`m\<preceq> q \<and> enum`m \<in> \<D> ` k"
-  assumes "n\<in>nat" "p\<in>P" "P \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
+  assumes "n\<in>nat" "p\<in>\<bbbP>" "\<bbbP> \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
   shows
-    "f`0 = p" "f`succ(n)\<preceq> f`n \<and> f`succ(n) \<in> \<D> ` n" "f`succ(n) \<in> P"
+    "f`0 = p" "f`succ(n)\<preceq> f`n \<and> f`succ(n) \<in> \<D> ` n" "f`succ(n) \<in> \<bbbP>"
 proof -
   from assms
   show "f`0 = p" by simp
   {
     fix x k
-    assume "x\<in>P" "k\<in>nat"
+    assume "x\<in>\<bbbP>" "k\<in>nat"
     then
-    have "\<exists>q\<in>P. q\<preceq> x \<and> q \<in> \<D> ` k"
+    have "\<exists>q\<in>\<bbbP>. q\<preceq> x \<and> q \<in> \<D> ` k"
       using seq_of_denses apply_funtype[OF countable_subs_of_P]
       unfolding dense_def by blast
   }
   with assms
-  show "f`succ(n)\<preceq> f`n \<and> f`succ(n) \<in> \<D> ` n" "f`succ(n)\<in>P"
+  show "f`succ(n)\<preceq> f`n \<and> f`succ(n) \<in> \<D> ` n" "f`succ(n)\<in>\<bbbP>"
     unfolding f_def using countable_RS_sequence_aux by simp_all
 qed
 
 lemma RS_seq_type:
-  assumes "n \<in> nat" "p\<in>P" "P \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
-  shows "RS_seq(n,P,leq,p,enum,\<D>) \<in> P"
+  assumes "n \<in> nat" "p\<in>\<bbbP>" "\<bbbP> \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
+  shows "RS_seq(n,\<bbbP>,leq,p,enum,\<D>) \<in> \<bbbP>"
   using assms countable_RS_sequence(1,3)
   by (induct;simp)
 
 lemma RS_seq_funtype:
-  assumes "p\<in>P" "P \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
-  shows "(\<lambda>n\<in>nat. RS_seq(n,P,leq,p,enum,\<D>)): nat \<rightarrow> P"
+  assumes "p\<in>\<bbbP>" "\<bbbP> \<subseteq> range(enum)" "enum:nat\<rightarrow>M"
+  shows "(\<lambda>n\<in>nat. RS_seq(n,\<bbbP>,leq,p,enum,\<D>)): nat \<rightarrow> \<bbbP>"
   using assms lam_type RS_seq_type by auto
 
 lemmas countable_rasiowa_sikorski =
   RS_sequence_imp_rasiowa_sikorski[OF _ RS_seq_funtype countable_RS_sequence(1,2)]
 
 end \<comment> \<open>\<^locale>\<open>countable_generic\<close>\<close>
 
 end
diff --git a/thys/Independence_CH/Forcing_Theorems.thy b/thys/Independence_CH/Forcing_Theorems.thy
--- a/thys/Independence_CH/Forcing_Theorems.thy
+++ b/thys/Independence_CH/Forcing_Theorems.thy
@@ -1,1528 +1,1528 @@
 section\<open>The Forcing Theorems\<close>
 
 theory Forcing_Theorems
   imports
     Cohen_Posets_Relative
     Forces_Definition
     Names
 
 begin
 
 context forcing_data1
 begin
 
 subsection\<open>The forcing relation in context\<close>
 
 lemma separation_forces :
   assumes
     fty: "\<phi>\<in>formula" and
     far: "arity(\<phi>)\<le>length(env)" and
     envty: "env\<in>list(M)"
   shows
     "separation(##M,\<lambda>p. (p \<tturnstile> \<phi> env))"
   using separation_ax arity_forces far fty envty arity_forces_le
-    transitivity[of _ P]
+    transitivity[of _ \<bbbP>]
   by simp
 
 lemma Collect_forces :
   assumes
     "\<phi>\<in>formula" and
     "arity(\<phi>)\<le>length(env)" and
     "env\<in>list(M)"
   shows
-    "{p\<in>P . p \<tturnstile> \<phi> env} \<in> M"
+    "{p\<in>\<bbbP> . p \<tturnstile> \<phi> env} \<in> M"
   using assms separation_forces separation_closed
   by simp
 
-lemma forces_mem_iff_dense_below:  "p\<in>P \<Longrightarrow> p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow> dense_below(
-    {q\<in>P. \<exists>s. \<exists>r. r\<in>P \<and> \<langle>s,r\<rangle> \<in> t2 \<and> q\<preceq>r \<and> q forces\<^sub>a (t1 = s)}
+lemma forces_mem_iff_dense_below:  "p\<in>\<bbbP> \<Longrightarrow> p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow> dense_below(
+    {q\<in>\<bbbP>. \<exists>s. \<exists>r. r\<in>\<bbbP> \<and> \<langle>s,r\<rangle> \<in> t2 \<and> q\<preceq>r \<and> q forces\<^sub>a (t1 = s)}
     ,p)"
   using def_forces_mem[of p t1 t2] by blast
 
 subsection\<open>Kunen 2013, Lemma IV.2.37(a)\<close>
 
 lemma strengthening_eq:
-  assumes "p\<in>P" "r\<in>P" "r\<preceq>p" "p forces\<^sub>a (t1 = t2)"
+  assumes "p\<in>\<bbbP>" "r\<in>\<bbbP>" "r\<preceq>p" "p forces\<^sub>a (t1 = t2)"
   shows "r forces\<^sub>a (t1 = t2)"
   using assms def_forces_eq[of _ t1 t2] leq_transD by blast
     (* Long proof *)
     (*
 proof -
   {
     fix s q
-    assume "q\<preceq> r" "q\<in>P"
+    assume "q\<preceq> r" "q\<in>\<bbbP>"
     with assms
     have "q\<preceq>p"
       using leq_preord unfolding preorder_on_def trans_on_def by blast
     moreover
-    note \<open>q\<in>P\<close> assms
+    note \<open>q\<in>\<bbbP>\<close> assms
     moreover
     assume "s\<in>domain(t1) \<union> domain(t2)"
     ultimately
     have "q forces\<^sub>a ( s \<in>  t1) \<longleftrightarrow> q forces\<^sub>a ( s \<in>  t2)"
       using def_forces_eq[of p t1 t2] by simp
   }
-  with \<open>r\<in>P\<close>
+  with \<open>r\<in>\<bbbP>\<close>
   show ?thesis using def_forces_eq[of r t1 t2] by blast
 qed
 *)
 
 subsection\<open>Kunen 2013, Lemma IV.2.37(a)\<close>
 lemma strengthening_mem:
-  assumes "p\<in>P" "r\<in>P" "r\<preceq>p" "p forces\<^sub>a (t1 \<in> t2)"
+  assumes "p\<in>\<bbbP>" "r\<in>\<bbbP>" "r\<preceq>p" "p forces\<^sub>a (t1 \<in> t2)"
   shows "r forces\<^sub>a (t1 \<in> t2)"
   using assms forces_mem_iff_dense_below dense_below_under by auto
 
 subsection\<open>Kunen 2013, Lemma IV.2.37(b)\<close>
 lemma density_mem:
-  assumes "p\<in>P"
-  shows "p forces\<^sub>a (t1 \<in> t2)  \<longleftrightarrow> dense_below({q\<in>P. q forces\<^sub>a (t1 \<in> t2)},p)"
+  assumes "p\<in>\<bbbP>"
+  shows "p forces\<^sub>a (t1 \<in> t2)  \<longleftrightarrow> dense_below({q\<in>\<bbbP>. q forces\<^sub>a (t1 \<in> t2)},p)"
 proof
   assume "p forces\<^sub>a (t1 \<in> t2)"
   with assms
-  show "dense_below({q\<in>P. q forces\<^sub>a (t1 \<in> t2)},p)"
+  show "dense_below({q\<in>\<bbbP>. q forces\<^sub>a (t1 \<in> t2)},p)"
     using forces_mem_iff_dense_below strengthening_mem[of p] ideal_dense_below by auto
 next
-  assume "dense_below({q \<in> P . q forces\<^sub>a ( t1 \<in>  t2)}, p)"
+  assume "dense_below({q \<in> \<bbbP> . q forces\<^sub>a ( t1 \<in>  t2)}, p)"
   with assms
-  have "dense_below({q\<in>P.
-    dense_below({q'\<in>P. \<exists>s r. r \<in> P \<and> \<langle>s,r\<rangle>\<in>t2 \<and> q'\<preceq>r \<and> q' forces\<^sub>a (t1 = s)},q)
+  have "dense_below({q\<in>\<bbbP>.
+    dense_below({q'\<in>\<bbbP>. \<exists>s r. r \<in> \<bbbP> \<and> \<langle>s,r\<rangle>\<in>t2 \<and> q'\<preceq>r \<and> q' forces\<^sub>a (t1 = s)},q)
     },p)"
     using forces_mem_iff_dense_below by simp
   with assms
   show "p forces\<^sub>a (t1 \<in> t2)"
     using dense_below_dense_below forces_mem_iff_dense_below[of p t1 t2] by blast
 qed
 
 lemma aux_density_eq:
   assumes
     "dense_below(
-    {q'\<in>P. \<forall>q. q\<in>P \<and> q\<preceq>q' \<longrightarrow> q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)}
+    {q'\<in>\<bbbP>. \<forall>q. q\<in>\<bbbP> \<and> q\<preceq>q' \<longrightarrow> q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)}
     ,p)"
-    "q forces\<^sub>a (s \<in> t1)" "q\<in>P" "p\<in>P" "q\<preceq>p"
+    "q forces\<^sub>a (s \<in> t1)" "q\<in>\<bbbP>" "p\<in>\<bbbP>" "q\<preceq>p"
   shows
-    "dense_below({r\<in>P. r forces\<^sub>a (s \<in> t2)},q)"
+    "dense_below({r\<in>\<bbbP>. r forces\<^sub>a (s \<in> t2)},q)"
 proof
   fix r
-  assume "r\<in>P" "r\<preceq>q"
-  moreover from this and \<open>p\<in>P\<close> \<open>q\<preceq>p\<close> \<open>q\<in>P\<close>
+  assume "r\<in>\<bbbP>" "r\<preceq>q"
+  moreover from this and \<open>p\<in>\<bbbP>\<close> \<open>q\<preceq>p\<close> \<open>q\<in>\<bbbP>\<close>
   have "r\<preceq>p"
     using leq_transD by simp
   moreover
-  note \<open>q forces\<^sub>a (s \<in> t1)\<close> \<open>dense_below(_,p)\<close> \<open>q\<in>P\<close>
+  note \<open>q forces\<^sub>a (s \<in> t1)\<close> \<open>dense_below(_,p)\<close> \<open>q\<in>\<bbbP>\<close>
   ultimately
-  obtain q1 where "q1\<preceq>r" "q1\<in>P" "q1 forces\<^sub>a (s \<in> t2)"
+  obtain q1 where "q1\<preceq>r" "q1\<in>\<bbbP>" "q1 forces\<^sub>a (s \<in> t2)"
     using strengthening_mem[of q _ s t1] refl_leq leq_transD[of _ r q] by blast
   then
-  show "\<exists>d\<in>{r \<in> P . r forces\<^sub>a ( s \<in>  t2)}. d \<in> P \<and> d\<preceq> r"
+  show "\<exists>d\<in>{r \<in> \<bbbP> . r forces\<^sub>a ( s \<in>  t2)}. d \<in> \<bbbP> \<and> d\<preceq> r"
     by blast
 qed
 
 (* Kunen 2013, Lemma IV.2.37(b) *)
 lemma density_eq:
-  assumes "p\<in>P"
-  shows "p forces\<^sub>a (t1 = t2)  \<longleftrightarrow> dense_below({q\<in>P. q forces\<^sub>a (t1 = t2)},p)"
+  assumes "p\<in>\<bbbP>"
+  shows "p forces\<^sub>a (t1 = t2)  \<longleftrightarrow> dense_below({q\<in>\<bbbP>. q forces\<^sub>a (t1 = t2)},p)"
 proof
   assume "p forces\<^sub>a (t1 = t2)"
-  with \<open>p\<in>P\<close>
-  show "dense_below({q\<in>P. q forces\<^sub>a (t1 = t2)},p)"
+  with \<open>p\<in>\<bbbP>\<close>
+  show "dense_below({q\<in>\<bbbP>. q forces\<^sub>a (t1 = t2)},p)"
     using strengthening_eq ideal_dense_below by auto
 next
-  assume "dense_below({q\<in>P. q forces\<^sub>a (t1 = t2)},p)"
+  assume "dense_below({q\<in>\<bbbP>. q forces\<^sub>a (t1 = t2)},p)"
   {
     fix s q
-    let ?D1="{q'\<in>P. \<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q \<in> P \<and> q\<preceq>q' \<longrightarrow>
+    let ?D1="{q'\<in>\<bbbP>. \<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q \<in> \<bbbP> \<and> q\<preceq>q' \<longrightarrow>
            q forces\<^sub>a (s \<in> t1)\<longleftrightarrow>q forces\<^sub>a (s \<in> t2)}"
-    let ?D2="{q'\<in>P. \<forall>q. q\<in>P \<and> q\<preceq>q' \<longrightarrow> q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)}"
+    let ?D2="{q'\<in>\<bbbP>. \<forall>q. q\<in>\<bbbP> \<and> q\<preceq>q' \<longrightarrow> q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)}"
     assume "s\<in>domain(t1) \<union> domain(t2)"
     then
     have "?D1\<subseteq>?D2" by blast
     with \<open>dense_below(_,p)\<close>
-    have "dense_below({q'\<in>P. \<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q \<in> P \<and> q\<preceq>q' \<longrightarrow>
+    have "dense_below({q'\<in>\<bbbP>. \<forall>s\<in>domain(t1) \<union> domain(t2). \<forall>q. q \<in> \<bbbP> \<and> q\<preceq>q' \<longrightarrow>
            q forces\<^sub>a (s \<in> t1)\<longleftrightarrow>q forces\<^sub>a (s \<in> t2)},p)"
-      using dense_below_cong'[OF \<open>p\<in>P\<close> def_forces_eq[of _ t1 t2]] by simp
-    with \<open>p\<in>P\<close> \<open>?D1\<subseteq>?D2\<close>
-    have "dense_below({q'\<in>P. \<forall>q. q\<in>P \<and> q\<preceq>q' \<longrightarrow>
+      using dense_below_cong'[OF \<open>p\<in>\<bbbP>\<close> def_forces_eq[of _ t1 t2]] by simp
+    with \<open>p\<in>\<bbbP>\<close> \<open>?D1\<subseteq>?D2\<close>
+    have "dense_below({q'\<in>\<bbbP>. \<forall>q. q\<in>\<bbbP> \<and> q\<preceq>q' \<longrightarrow>
             q forces\<^sub>a (s \<in> t1) \<longleftrightarrow> q forces\<^sub>a (s \<in> t2)},p)"
       using dense_below_mono by simp
     moreover from this (* Automatic tools can't handle this symmetry
                           in order to apply aux_density_eq below *)
-    have  "dense_below({q'\<in>P. \<forall>q. q\<in>P \<and> q\<preceq>q' \<longrightarrow>
+    have  "dense_below({q'\<in>\<bbbP>. \<forall>q. q\<in>\<bbbP> \<and> q\<preceq>q' \<longrightarrow>
             q forces\<^sub>a (s \<in> t2) \<longleftrightarrow> q forces\<^sub>a (s \<in> t1)},p)"
       by blast
     moreover
-    assume "q \<in> P" "q\<preceq>p"
+    assume "q \<in> \<bbbP>" "q\<preceq>p"
     moreover
-    note \<open>p\<in>P\<close>
+    note \<open>p\<in>\<bbbP>\<close>
     ultimately (*We can omit the next step but it is slower *)
-    have "q forces\<^sub>a (s \<in> t1) \<Longrightarrow> dense_below({r\<in>P. r forces\<^sub>a (s \<in> t2)},q)"
-      "q forces\<^sub>a (s \<in> t2) \<Longrightarrow> dense_below({r\<in>P. r forces\<^sub>a (s \<in> t1)},q)"
+    have "q forces\<^sub>a (s \<in> t1) \<Longrightarrow> dense_below({r\<in>\<bbbP>. r forces\<^sub>a (s \<in> t2)},q)"
+      "q forces\<^sub>a (s \<in> t2) \<Longrightarrow> dense_below({r\<in>\<bbbP>. r forces\<^sub>a (s \<in> t1)},q)"
       using aux_density_eq by simp_all
     then
     have "q forces\<^sub>a ( s \<in>  t1) \<longleftrightarrow> q forces\<^sub>a ( s \<in>  t2)"
-      using density_mem[OF \<open>q\<in>P\<close>] by blast
+      using density_mem[OF \<open>q\<in>\<bbbP>\<close>] by blast
   }
-  with \<open>p\<in>P\<close>
+  with \<open>p\<in>\<bbbP>\<close>
   show "p forces\<^sub>a (t1 = t2)" using def_forces_eq by blast
 qed
 
 subsection\<open>Kunen 2013, Lemma IV.2.38\<close>
 lemma not_forces_neq:
-  assumes "p\<in>P"
-  shows "p forces\<^sub>a (t1 = t2) \<longleftrightarrow> \<not> (\<exists>q\<in>P. q\<preceq>p \<and> q forces\<^sub>a (t1 \<noteq> t2))"
+  assumes "p\<in>\<bbbP>"
+  shows "p forces\<^sub>a (t1 = t2) \<longleftrightarrow> \<not> (\<exists>q\<in>\<bbbP>. q\<preceq>p \<and> q forces\<^sub>a (t1 \<noteq> t2))"
   using assms density_eq unfolding forces_neq_def by blast
 
 lemma not_forces_nmem:
-  assumes "p\<in>P"
-  shows "p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow> \<not> (\<exists>q\<in>P. q\<preceq>p \<and> q forces\<^sub>a (t1 \<notin> t2))"
+  assumes "p\<in>\<bbbP>"
+  shows "p forces\<^sub>a (t1 \<in> t2) \<longleftrightarrow> \<not> (\<exists>q\<in>\<bbbP>. q\<preceq>p \<and> q forces\<^sub>a (t1 \<notin> t2))"
   using assms density_mem unfolding forces_nmem_def by blast
 
 subsection\<open>The relation of forcing and atomic formulas\<close>
 lemma Forces_Equal:
   assumes
-    "p\<in>P" "t1\<in>M" "t2\<in>M" "env\<in>list(M)" "nth(n,env) = t1" "nth(m,env) = t2" "n\<in>nat" "m\<in>nat"
+    "p\<in>\<bbbP>" "t1\<in>M" "t2\<in>M" "env\<in>list(M)" "nth(n,env) = t1" "nth(m,env) = t2" "n\<in>nat" "m\<in>nat"
   shows
     "(p \<tturnstile> Equal(n,m) env) \<longleftrightarrow> p forces\<^sub>a (t1 = t2)"
   using assms sats_forces_Equal forces_eq_abs transitivity
   by simp
 
 lemma Forces_Member:
   assumes
-    "p\<in>P" "t1\<in>M" "t2\<in>M" "env\<in>list(M)" "nth(n,env) = t1" "nth(m,env) = t2" "n\<in>nat" "m\<in>nat"
+    "p\<in>\<bbbP>" "t1\<in>M" "t2\<in>M" "env\<in>list(M)" "nth(n,env) = t1" "nth(m,env) = t2" "n\<in>nat" "m\<in>nat"
   shows
     "(p \<tturnstile> Member(n,m) env) \<longleftrightarrow> p forces\<^sub>a (t1 \<in> t2)"
   using assms sats_forces_Member forces_mem_abs transitivity
   by simp
 
 lemma Forces_Neg:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula"
   shows
-    "(p \<tturnstile> Neg(\<phi>) env) \<longleftrightarrow> \<not>(\<exists>q\<in>M. q\<in>P \<and> q\<preceq>p \<and> (q \<tturnstile> \<phi> env))"
+    "(p \<tturnstile> Neg(\<phi>) env) \<longleftrightarrow> \<not>(\<exists>q\<in>M. q\<in>\<bbbP> \<and> q\<preceq>p \<and> (q \<tturnstile> \<phi> env))"
   using assms sats_forces_Neg transitivity pair_in_M_iff leq_abs
   by simp
 
 subsection\<open>The relation of forcing and connectives\<close>
 
 lemma Forces_Nand:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
   shows
-    "(p \<tturnstile> Nand(\<phi>,\<psi>) env) \<longleftrightarrow> \<not>(\<exists>q\<in>M. q\<in>P \<and> q\<preceq>p \<and> (q \<tturnstile> \<phi> env) \<and> (q \<tturnstile> \<psi> env))"
+    "(p \<tturnstile> Nand(\<phi>,\<psi>) env) \<longleftrightarrow> \<not>(\<exists>q\<in>M. q\<in>\<bbbP> \<and> q\<preceq>p \<and> (q \<tturnstile> \<phi> env) \<and> (q \<tturnstile> \<psi> env))"
   using assms sats_forces_Nand transitivity pair_in_M_iff leq_abs by simp
 
 lemma Forces_And_aux:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
   shows
     "p \<tturnstile> And(\<phi>,\<psi>) env   \<longleftrightarrow>
-    (\<forall>q\<in>M. q\<in>P \<and> q\<preceq>p \<longrightarrow> (\<exists>r\<in>M. r\<in>P \<and> r\<preceq>q \<and> (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)))"
+    (\<forall>q\<in>M. q\<in>\<bbbP> \<and> q\<preceq>p \<longrightarrow> (\<exists>r\<in>M. r\<in>\<bbbP> \<and> r\<preceq>q \<and> (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)))"
   unfolding And_def using assms Forces_Neg Forces_Nand by (auto simp only:)
 
 lemma Forces_And_iff_dense_below:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
   shows
-    "(p \<tturnstile> And(\<phi>,\<psi>) env) \<longleftrightarrow> dense_below({r\<in>P. (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env) },p)"
+    "(p \<tturnstile> And(\<phi>,\<psi>) env) \<longleftrightarrow> dense_below({r\<in>\<bbbP>. (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env) },p)"
   unfolding dense_below_def using Forces_And_aux assms
   by (auto dest:transitivity[OF _ P_in_M]; rename_tac q; drule_tac x=q in bspec)+
 
 lemma Forces_Forall:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula"
   shows
     "(p \<tturnstile> Forall(\<phi>) env) \<longleftrightarrow> (\<forall>x\<in>M. (p \<tturnstile> \<phi> ([x] @ env)))"
   using sats_forces_Forall assms transitivity[OF _ P_in_M]
   by simp
 
 (* "x\<in>val(G,\<pi>) \<Longrightarrow> \<exists>\<theta>. \<exists>p\<in>G.  \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x" *)
 bundle some_rules =  elem_of_val_pair [dest]
 
 context
   includes some_rules
 begin
 
-lemma elem_of_valI: "\<exists>\<theta>. \<exists>p\<in>P. p\<in>G \<and> \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x \<Longrightarrow> x\<in>val(G,\<pi>)"
+lemma elem_of_valI: "\<exists>\<theta>. \<exists>p\<in>\<bbbP>. p\<in>G \<and> \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x \<Longrightarrow> x\<in>val(G,\<pi>)"
   by (subst def_val, auto)
 
 lemma GenExt_iff: "x\<in>M[G] \<longleftrightarrow> (\<exists>\<tau>\<in>M. x = val(G,\<tau>))"
   unfolding GenExt_def by simp
 end
 
 end
 context G_generic1
   
 begin
 
 subsection\<open>Kunen 2013, Lemma IV.2.29\<close>
 lemma generic_inter_dense_below:
   assumes "D\<in>M" "dense_below(D,p)" "p\<in>G"
   shows "D \<inter> G \<noteq> 0"
 proof -
-  let ?D="{q\<in>P. p\<bottom>q \<or> q\<in>D}"
+  let ?D="{q\<in>\<bbbP>. p\<bottom>q \<or> q\<in>D}"
   have "dense(?D)"
   proof
     fix r
-    assume "r\<in>P"
-    show "\<exists>d\<in>{q \<in> P . p \<bottom> q \<or> q \<in> D}. d \<preceq> r"
+    assume "r\<in>\<bbbP>"
+    show "\<exists>d\<in>{q \<in> \<bbbP> . p \<bottom> q \<or> q \<in> D}. d \<preceq> r"
     proof (cases "p \<bottom> r")
       case True
-      with \<open>r\<in>P\<close>
+      with \<open>r\<in>\<bbbP>\<close>
         (* Automatic tools can't handle this case for some reason... *)
       show ?thesis using refl_leq[of r] by (intro bexI) (blast+)
     next
       case False
       then
-      obtain s where "s\<in>P" "s\<preceq>p" "s\<preceq>r" by blast
-      with assms \<open>r\<in>P\<close>
+      obtain s where "s\<in>\<bbbP>" "s\<preceq>p" "s\<preceq>r" by blast
+      with assms \<open>r\<in>\<bbbP>\<close>
       show ?thesis
         using dense_belowD[OF assms(2), of s] leq_transD[of _ s r]
         by blast
     qed
   qed
-  have "?D\<subseteq>P" by auto
+  have "?D\<subseteq>\<bbbP>" by auto
   let ?d_fm="\<cdot>\<cdot>\<not>compat_in_fm(1, 2, 3, 0) \<cdot> \<or> \<cdot>0 \<in> 4\<cdot>\<cdot>"
   from \<open>p\<in>G\<close>
   have "p\<in>M"
     using G_subset_M subsetD by simp
   moreover
   have "?d_fm\<in>formula" by simp
   moreover
   have "arity(?d_fm) = 5"
     by (auto simp add: arity)
   moreover from \<open>D\<in>M\<close> \<open>p\<in>M\<close>
-  have "(M, [q,P,leq,p,D] \<Turnstile> ?d_fm) \<longleftrightarrow> (\<not> is_compat_in(##M,P,leq,p,q) \<or> q\<in>D)"
+  have "(M, [q,\<bbbP>,leq,p,D] \<Turnstile> ?d_fm) \<longleftrightarrow> (\<not> is_compat_in(##M,\<bbbP>,leq,p,q) \<or> q\<in>D)"
     if "q\<in>M" for q
     using that sats_compat_in_fm zero_in_M
     by simp
   moreover from \<open>p\<in>M\<close>
-  have "(\<not> is_compat_in(##M,P,leq,p,q) \<or> q\<in>D) \<longleftrightarrow> p\<bottom>q \<or> q\<in>D" if "q\<in>M" for q
+  have "(\<not> is_compat_in(##M,\<bbbP>,leq,p,q) \<or> q\<in>D) \<longleftrightarrow> p\<bottom>q \<or> q\<in>D" if "q\<in>M" for q
     unfolding compat_def
     using that compat_in_abs
     by simp
   ultimately
   have "?D\<in>M"
-    using Collect_in_M[of ?d_fm "[P,leq,p,D]"] \<open>D\<in>M\<close>
+    using Collect_in_M[of ?d_fm "[\<bbbP>,leq,p,D]"] \<open>D\<in>M\<close>
     by simp
-  note asm = \<open>dense(?D)\<close> \<open>?D\<subseteq>P\<close> \<open>?D\<in>M\<close>
+  note asm = \<open>dense(?D)\<close> \<open>?D\<subseteq>\<bbbP>\<close> \<open>?D\<in>M\<close>
   obtain x where "x\<in>G" "x\<in>?D" 
     using M_generic_denseD[OF asm]
     by force (* by (erule bexE) does it, but the other automatic tools don't *)
   moreover from this
   have "x\<in>D"
     using M_generic_compatD[OF _ \<open>p\<in>G\<close>, of x] refl_leq compatI[of _ p x]
     by force
   ultimately
   show ?thesis by auto
 qed
 
 subsection\<open>Auxiliary results for Lemma IV.2.40(a)\<close>
 lemma (in forcing_data1) IV240a_mem_Collect:
   assumes
     "\<pi>\<in>M" "\<tau>\<in>M"
   shows
-    "{q\<in>P. \<exists>\<sigma>. \<exists>r. r\<in>P \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)}\<in>M"
+    "{q\<in>\<bbbP>. \<exists>\<sigma>. \<exists>r. r\<in>\<bbbP> \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)}\<in>M"
 proof -
   let ?rel_pred= "\<lambda>M x a1 a2 a3 a4. \<exists>\<sigma>[M]. \<exists>r[M]. \<exists>\<sigma>r[M].
                 r\<in>a1 \<and> pair(M,\<sigma>,r,\<sigma>r) \<and> \<sigma>r\<in>a4 \<and> is_leq(M,a2,x,r) \<and> is_forces_eq'(M,a1,a2,x,a3,\<sigma>)"
   let ?\<phi>="Exists(Exists(Exists(And(Member(1,4),And(pair_fm(2,1,0),
           And(Member(0,7),And(is_leq_fm(5,3,1),forces_eq_fm(4,5,3,6,2))))))))"
   have "\<sigma>\<in>M \<and> r\<in>M" if "\<langle>\<sigma>, r\<rangle> \<in> \<tau>"  for \<sigma> r
     using that \<open>\<tau>\<in>M\<close> pair_in_M_iff transitivity[of "\<langle>\<sigma>,r\<rangle>" \<tau>] by simp
   then
-  have "?rel_pred(##M,q,P,leq,\<pi>,\<tau>) \<longleftrightarrow> (\<exists>\<sigma>. \<exists>r. r\<in>P \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>))"
+  have "?rel_pred(##M,q,\<bbbP>,leq,\<pi>,\<tau>) \<longleftrightarrow> (\<exists>\<sigma>. \<exists>r. r\<in>\<bbbP> \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>))"
     if "q\<in>M" for q
     unfolding forces_eq_def
     using assms that leq_abs forces_eq'_abs pair_in_M_iff
     by auto
   moreover
-  have "(M, [q,P,leq,\<pi>,\<tau>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,q,P,leq,\<pi>,\<tau>)" if "q\<in>M" for q
+  have "(M, [q,\<bbbP>,leq,\<pi>,\<tau>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,q,\<bbbP>,leq,\<pi>,\<tau>)" if "q\<in>M" for q
     using assms that sats_forces_eq_fm sats_is_leq_fm zero_in_M
     by simp
   moreover
   have "?\<phi>\<in>formula" by simp
   moreover
   have "arity(?\<phi>)=5"
     using arity_forces_eq_fm
     by (simp add:ord_simp_union arity)
   ultimately
   show ?thesis
-    unfolding forces_eq_def using assms Collect_in_M[of ?\<phi> "[P,leq,\<pi>,\<tau>]"]
+    unfolding forces_eq_def using assms Collect_in_M[of ?\<phi> "[\<bbbP>,leq,\<pi>,\<tau>]"]
     by simp
 qed
 
 (* Lemma IV.2.40(a), membership *)
 lemma IV240a_mem:
   assumes
     "p\<in>G" "\<pi>\<in>M" "\<tau>\<in>M" "p forces\<^sub>a (\<pi> \<in> \<tau>)"
-    "\<And>q \<sigma>. q\<in>P \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<Longrightarrow> q forces\<^sub>a (\<pi> = \<sigma>) \<Longrightarrow>
+    "\<And>q \<sigma>. q\<in>\<bbbP> \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<Longrightarrow> q forces\<^sub>a (\<pi> = \<sigma>) \<Longrightarrow>
       val(G,\<pi>) = val(G,\<sigma>)" (* inductive hypothesis *)
   shows
     "val(G,\<pi>)\<in>val(G,\<tau>)"
 proof (intro elem_of_valI)
-  let ?D="{q\<in>P. \<exists>\<sigma>. \<exists>r. r\<in>P \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)}"
+  let ?D="{q\<in>\<bbbP>. \<exists>\<sigma>. \<exists>r. r\<in>\<bbbP> \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)}"
   from \<open>p\<in>G\<close>
-  have "p\<in>P" by blast
+  have "p\<in>\<bbbP>" by blast
   moreover
   note \<open>\<pi>\<in>M\<close> \<open>\<tau>\<in>M\<close>
   ultimately
   have "?D \<in> M" using IV240a_mem_Collect by simp
-  moreover from assms \<open>p\<in>P\<close>
+  moreover from assms \<open>p\<in>\<bbbP>\<close>
   have "dense_below(?D,p)"
     using forces_mem_iff_dense_below by simp
   moreover
   note \<open>p\<in>G\<close>
   ultimately
   obtain q where "q\<in>G" "q\<in>?D" 
     using generic_inter_dense_below[of ?D p] by blast
   then
-  obtain \<sigma> r where "r\<in>P" "\<langle>\<sigma>,r\<rangle> \<in> \<tau>" "q\<preceq>r" "q forces\<^sub>a (\<pi> = \<sigma>)" by blast
+  obtain \<sigma> r where "r\<in>\<bbbP>" "\<langle>\<sigma>,r\<rangle> \<in> \<tau>" "q\<preceq>r" "q forces\<^sub>a (\<pi> = \<sigma>)" by blast
   moreover from this and \<open>q\<in>G\<close> assms
   have "r \<in> G" "val(G,\<pi>) = val(G,\<sigma>)" by blast+
   ultimately
-  show "\<exists> \<sigma>. \<exists>p\<in>P. p \<in> G \<and> \<langle>\<sigma>, p\<rangle> \<in> \<tau> \<and> val(G, \<sigma>) = val(G, \<pi>)" by auto
+  show "\<exists> \<sigma>. \<exists>p\<in>\<bbbP>. p \<in> G \<and> \<langle>\<sigma>, p\<rangle> \<in> \<tau> \<and> val(G, \<sigma>) = val(G, \<pi>)" by auto
 qed
 
 (* Example IV.2.36 (next two lemmas) *)
-lemma refl_forces_eq:"p\<in>P \<Longrightarrow> p forces\<^sub>a (x = x)"
+lemma refl_forces_eq:"p\<in>\<bbbP> \<Longrightarrow> p forces\<^sub>a (x = x)"
   using def_forces_eq by simp
 
-lemma forces_memI: "\<langle>\<sigma>,r\<rangle>\<in>\<tau> \<Longrightarrow> p\<in>P \<Longrightarrow> r\<in>P \<Longrightarrow> p\<preceq>r \<Longrightarrow> p forces\<^sub>a (\<sigma> \<in> \<tau>)"
+lemma forces_memI: "\<langle>\<sigma>,r\<rangle>\<in>\<tau> \<Longrightarrow> p\<in>\<bbbP> \<Longrightarrow> r\<in>\<bbbP> \<Longrightarrow> p\<preceq>r \<Longrightarrow> p forces\<^sub>a (\<sigma> \<in> \<tau>)"
   using refl_forces_eq[of _ \<sigma>] leq_transD refl_leq
   by (blast intro:forces_mem_iff_dense_below[THEN iffD2])
 
 (* Lemma IV.2.40(a), equality, first inclusion *)
 lemma IV240a_eq_1st_incl:
   includes some_rules
   assumes
     "p\<in>G" "p forces\<^sub>a (\<tau> = \<theta>)"
     and
-    IH:"\<And>q \<sigma>. q\<in>P \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
+    IH:"\<And>q \<sigma>. q\<in>\<bbbP> \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
         (q forces\<^sub>a (\<sigma> \<in> \<tau>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<tau>)) \<and>
         (q forces\<^sub>a (\<sigma> \<in> \<theta>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<theta>))"
     (* Strong enough for this case: *)
-    (*  IH:"\<And>q \<sigma>. q\<in>P \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<Longrightarrow> q forces\<^sub>a (\<sigma> \<in> \<theta>) \<Longrightarrow>
+    (*  IH:"\<And>q \<sigma>. q\<in>\<bbbP> \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<Longrightarrow> q forces\<^sub>a (\<sigma> \<in> \<theta>) \<Longrightarrow>
       val(G,\<sigma>) \<in> val(G,\<theta>)" *)
   shows
     "val(G,\<tau>) \<subseteq> val(G,\<theta>)"
 proof
   fix x
   assume "x\<in>val(G,\<tau>)"
   then
   obtain \<sigma> r where "\<langle>\<sigma>,r\<rangle>\<in>\<tau>" "r\<in>G" "val(G,\<sigma>)=x" by blast
   moreover from this and \<open>p\<in>G\<close>
   obtain q where "q\<in>G" "q\<preceq>p" "q\<preceq>r" by force
   moreover from this and \<open>p\<in>G\<close>
-  have "q\<in>P" "p\<in>P" by blast+
+  have "q\<in>\<bbbP>" "p\<in>\<bbbP>" by blast+
   moreover from calculation
   have "q forces\<^sub>a (\<sigma> \<in> \<tau>)"
     using forces_memI by auto
   moreover
   note \<open>p forces\<^sub>a (\<tau> = \<theta>)\<close>
   ultimately
   have "q forces\<^sub>a (\<sigma> \<in> \<theta>)"
     using def_forces_eq by auto
-  with \<open>q\<in>P\<close> \<open>q\<in>G\<close> IH[of q \<sigma>] \<open>\<langle>\<sigma>,r\<rangle>\<in>\<tau>\<close> \<open>val(G,\<sigma>) = x\<close>
+  with \<open>q\<in>\<bbbP>\<close> \<open>q\<in>G\<close> IH[of q \<sigma>] \<open>\<langle>\<sigma>,r\<rangle>\<in>\<tau>\<close> \<open>val(G,\<sigma>) = x\<close>
   show "x\<in>val(G,\<theta>)" by blast
 qed
 
-(* Lemma IV.2.40(a), equality, second inclusion--- COPY-PASTE *)
+(* Lemma IV.2.40(a), equality, second inclusion--- CO\<bbbP>Y-\<bbbP>ASTE *)
 lemma IV240a_eq_2nd_incl:
   includes some_rules
   assumes
     "p\<in>G" "p forces\<^sub>a (\<tau> = \<theta>)"
     and
-    IH:"\<And>q \<sigma>. q\<in>P \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
+    IH:"\<And>q \<sigma>. q\<in>\<bbbP> \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
         (q forces\<^sub>a (\<sigma> \<in> \<tau>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<tau>)) \<and>
         (q forces\<^sub>a (\<sigma> \<in> \<theta>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<theta>))"
   shows
     "val(G,\<theta>) \<subseteq> val(G,\<tau>)"
 proof
   fix x
   assume "x\<in>val(G,\<theta>)"
   then
   obtain \<sigma> r where "\<langle>\<sigma>,r\<rangle>\<in>\<theta>" "r\<in>G" "val(G,\<sigma>)=x" by blast
   moreover from this and \<open>p\<in>G\<close>
   obtain q where "q\<in>G" "q\<preceq>p" "q\<preceq>r" by force
   moreover from this and \<open>p\<in>G\<close>
-  have "q\<in>P" "p\<in>P" by blast+
+  have "q\<in>\<bbbP>" "p\<in>\<bbbP>" by blast+
   moreover from calculation
   have "q forces\<^sub>a (\<sigma> \<in> \<theta>)"
     using forces_memI by auto
   moreover
   note \<open>p forces\<^sub>a (\<tau> = \<theta>)\<close>
   ultimately
   have "q forces\<^sub>a (\<sigma> \<in> \<tau>)"
     using def_forces_eq by auto
-  with \<open>q\<in>P\<close> \<open>q\<in>G\<close> IH[of q \<sigma>] \<open>\<langle>\<sigma>,r\<rangle>\<in>\<theta>\<close> \<open>val(G,\<sigma>) = x\<close>
+  with \<open>q\<in>\<bbbP>\<close> \<open>q\<in>G\<close> IH[of q \<sigma>] \<open>\<langle>\<sigma>,r\<rangle>\<in>\<theta>\<close> \<open>val(G,\<sigma>) = x\<close>
   show "x\<in>val(G,\<tau>)" by blast
 qed
 
-(* Lemma IV.2.40(a), equality, second inclusion--- COPY-PASTE *)
+(* Lemma IV.2.40(a), equality, second inclusion--- CO\<bbbP>Y-\<bbbP>ASTE *)
 lemma IV240a_eq:
   includes some_rules
   assumes
     "p\<in>G" "p forces\<^sub>a (\<tau> = \<theta>)"
     and
-    IH:"\<And>q \<sigma>. q\<in>P \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
+    IH:"\<And>q \<sigma>. q\<in>\<bbbP> \<Longrightarrow> q\<in>G \<Longrightarrow> \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
         (q forces\<^sub>a (\<sigma> \<in> \<tau>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<tau>)) \<and>
         (q forces\<^sub>a (\<sigma> \<in> \<theta>) \<longrightarrow> val(G,\<sigma>) \<in> val(G,\<theta>))"
   shows
     "val(G,\<tau>) = val(G,\<theta>)"
   using IV240a_eq_1st_incl[OF assms] IV240a_eq_2nd_incl[OF assms] IH by blast
 
 subsection\<open>Induction on names\<close>
 
 lemma (in forcing_data1) core_induction:
   assumes
-    "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(0,\<tau>,\<sigma>,q)\<rbrakk> \<Longrightarrow> Q(1,\<tau>,\<theta>,p)"
-    "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(1,\<sigma>,\<tau>,q) \<and> Q(1,\<sigma>,\<theta>,q)\<rbrakk> \<Longrightarrow> Q(0,\<tau>,\<theta>,p)"
-    "ft \<in> 2" "p \<in> P"
+    "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(0,\<tau>,\<sigma>,q)\<rbrakk> \<Longrightarrow> Q(1,\<tau>,\<theta>,p)"
+    "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(1,\<sigma>,\<tau>,q) \<and> Q(1,\<sigma>,\<theta>,q)\<rbrakk> \<Longrightarrow> Q(0,\<tau>,\<theta>,p)"
+    "ft \<in> 2" "p \<in> \<bbbP>"
   shows
     "Q(ft,\<tau>,\<theta>,p)"
 proof -
   {
     fix ft p \<tau> \<theta>
     have "Transset(eclose({\<tau>,\<theta>}))" (is "Transset(?e)")
       using Transset_eclose by simp
     have "\<tau> \<in> ?e" "\<theta> \<in> ?e"
       using arg_into_eclose by simp_all
     moreover
-    assume "ft \<in> 2" "p \<in> P"
+    assume "ft \<in> 2" "p \<in> \<bbbP>"
     ultimately
-    have "\<langle>ft,\<tau>,\<theta>,p\<rangle>\<in> 2\<times>?e\<times>?e\<times>P" (is "?a\<in>2\<times>?e\<times>?e\<times>P") by simp
+    have "\<langle>ft,\<tau>,\<theta>,p\<rangle>\<in> 2\<times>?e\<times>?e\<times>\<bbbP>" (is "?a\<in>2\<times>?e\<times>?e\<times>\<bbbP>") by simp
     then
     have "Q(ftype(?a), name1(?a), name2(?a), cond_of(?a))"
-      using core_induction_aux[of ?e P Q ?a,OF \<open>Transset(?e)\<close> assms(1,2) \<open>?a\<in>_\<close>]
+      using core_induction_aux[of ?e \<bbbP> Q ?a,OF \<open>Transset(?e)\<close> assms(1,2) \<open>?a\<in>_\<close>]
       by (clarify) (blast)
     then have "Q(ft,\<tau>,\<theta>,p)" by (simp add:components_simp)
   }
   then show ?thesis using assms by simp
 qed
 
 lemma (in forcing_data1) forces_induction_with_conds:
   assumes
-    "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(q,\<tau>,\<sigma>)\<rbrakk> \<Longrightarrow> R(p,\<tau>,\<theta>)"
-    "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> R(q,\<sigma>,\<tau>) \<and> R(q,\<sigma>,\<theta>)\<rbrakk> \<Longrightarrow> Q(p,\<tau>,\<theta>)"
-    "p \<in> P"
+    "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> Q(q,\<tau>,\<sigma>)\<rbrakk> \<Longrightarrow> R(p,\<tau>,\<theta>)"
+    "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> R(q,\<sigma>,\<tau>) \<and> R(q,\<sigma>,\<theta>)\<rbrakk> \<Longrightarrow> Q(p,\<tau>,\<theta>)"
+    "p \<in> \<bbbP>"
   shows
     "Q(p,\<tau>,\<theta>) \<and> R(p,\<tau>,\<theta>)"
 proof -
   let ?Q="\<lambda>ft \<tau> \<theta> p. (ft = 0 \<longrightarrow> Q(p,\<tau>,\<theta>)) \<and> (ft = 1 \<longrightarrow> R(p,\<tau>,\<theta>))"
   from assms(1)
-  have "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> ?Q(0,\<tau>,\<sigma>,q)\<rbrakk> \<Longrightarrow> ?Q(1,\<tau>,\<theta>,p)"
+  have "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<theta>)\<rbrakk> \<Longrightarrow> ?Q(0,\<tau>,\<sigma>,q)\<rbrakk> \<Longrightarrow> ?Q(1,\<tau>,\<theta>,p)"
     by simp
   moreover from assms(2)
-  have "\<And>\<tau> \<theta> p. p \<in> P \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>P ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> ?Q(1,\<sigma>,\<tau>,q) \<and> ?Q(1,\<sigma>,\<theta>,q)\<rbrakk> \<Longrightarrow> ?Q(0,\<tau>,\<theta>,p)"
+  have "\<And>\<tau> \<theta> p. p \<in> \<bbbP> \<Longrightarrow> \<lbrakk>\<And>q \<sigma>. \<lbrakk>q\<in>\<bbbP> ; \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)\<rbrakk> \<Longrightarrow> ?Q(1,\<sigma>,\<tau>,q) \<and> ?Q(1,\<sigma>,\<theta>,q)\<rbrakk> \<Longrightarrow> ?Q(0,\<tau>,\<theta>,p)"
     by simp
   moreover
-  note \<open>p\<in>P\<close>
+  note \<open>p\<in>\<bbbP>\<close>
   ultimately
   have "?Q(ft,\<tau>,\<theta>,p)" if "ft\<in>2" for ft
     by (rule core_induction[OF _ _ that, of ?Q])
   then
   show ?thesis by auto
 qed
 
 lemma (in forcing_data1) forces_induction:
   assumes
     "\<And>\<tau> \<theta>. \<lbrakk>\<And>\<sigma>. \<sigma>\<in>domain(\<theta>) \<Longrightarrow> Q(\<tau>,\<sigma>)\<rbrakk> \<Longrightarrow> R(\<tau>,\<theta>)"
     "\<And>\<tau> \<theta>. \<lbrakk>\<And>\<sigma>. \<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow> R(\<sigma>,\<tau>) \<and> R(\<sigma>,\<theta>)\<rbrakk> \<Longrightarrow> Q(\<tau>,\<theta>)"
   shows
     "Q(\<tau>,\<theta>) \<and> R(\<tau>,\<theta>)"
 proof (intro forces_induction_with_conds[OF _ _ one_in_P ])
   fix \<tau> \<theta> p
-  assume "q \<in> P \<Longrightarrow> \<sigma> \<in> domain(\<theta>) \<Longrightarrow> Q(\<tau>, \<sigma>)" for q \<sigma>
+  assume "q \<in> \<bbbP> \<Longrightarrow> \<sigma> \<in> domain(\<theta>) \<Longrightarrow> Q(\<tau>, \<sigma>)" for q \<sigma>
   with assms(1)
   show "R(\<tau>,\<theta>)"
     using one_in_P by simp
 next
   fix \<tau> \<theta> p
-  assume "q \<in> P \<Longrightarrow> \<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow> R(\<sigma>,\<tau>) \<and> R(\<sigma>,\<theta>)" for q \<sigma>
+  assume "q \<in> \<bbbP> \<Longrightarrow> \<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow> R(\<sigma>,\<tau>) \<and> R(\<sigma>,\<theta>)" for q \<sigma>
   with assms(2)
   show "Q(\<tau>,\<theta>)"
     using one_in_P by simp
 qed
 
 subsection\<open>Lemma IV.2.40(a), in full\<close>
 lemma IV240a:
   shows
     "(\<tau>\<in>M \<longrightarrow> \<theta>\<in>M \<longrightarrow> (\<forall>p\<in>G. p forces\<^sub>a (\<tau> = \<theta>) \<longrightarrow> val(G,\<tau>) = val(G,\<theta>))) \<and>
      (\<tau>\<in>M \<longrightarrow> \<theta>\<in>M \<longrightarrow> (\<forall>p\<in>G. p forces\<^sub>a (\<tau> \<in> \<theta>) \<longrightarrow> val(G,\<tau>) \<in> val(G,\<theta>)))"
     (is "?Q(\<tau>,\<theta>) \<and> ?R(\<tau>,\<theta>)")
 proof (intro forces_induction[of ?Q ?R] impI)
   fix \<tau> \<theta>
   assume "\<tau>\<in>M" "\<theta>\<in>M"  "\<sigma>\<in>domain(\<theta>) \<Longrightarrow> ?Q(\<tau>,\<sigma>)" for \<sigma>
   moreover from this
   have "\<sigma>\<in>domain(\<theta>) \<Longrightarrow> q forces\<^sub>a (\<tau> = \<sigma>) \<Longrightarrow> val(G, \<tau>) = val(G, \<sigma>)"
-    if "q\<in>P" "q\<in>G" for q \<sigma>
+    if "q\<in>\<bbbP>" "q\<in>G" for q \<sigma>
     using that domain_closed[of \<theta>] transitivity by auto
   ultimately
   show "\<forall>p\<in>G. p forces\<^sub>a (\<tau> \<in> \<theta>) \<longrightarrow> val(G,\<tau>) \<in> val(G,\<theta>)"
     using IV240a_mem domain_closed transitivity by simp
 next
   fix \<tau> \<theta>
   assume "\<tau>\<in>M" "\<theta>\<in>M" and d:"\<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow> ?R(\<sigma>,\<tau>) \<and> ?R(\<sigma>,\<theta>)" for \<sigma>
   moreover from this
   have IH':"(q forces\<^sub>a (\<sigma> \<in> \<tau>) \<longrightarrow> val(G, \<sigma>) \<in> val(G, \<tau>)) \<and>
             (q forces\<^sub>a (\<sigma> \<in> \<theta>) \<longrightarrow> val(G, \<sigma>) \<in> val(G, \<theta>))" 
     if "\<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>)" "q\<in>G" for q \<sigma>
   proof -
     from d that
     have A:"?R(\<sigma>,\<tau>)" "?R(\<sigma>,\<theta>)"
       by auto
     from \<open>\<tau>\<in>_\<close> \<open>\<theta>\<in>M\<close> \<open>q\<in>G\<close> \<open>\<sigma>\<in>_\<close>
      show ?thesis
       using transitivity[of \<sigma>] domain_closed A[rule_format,of q]
       by auto
   qed
   show "\<forall>p\<in>G. p forces\<^sub>a (\<tau> = \<theta>) \<longrightarrow> val(G,\<tau>) = val(G,\<theta>)"
     using IV240a_eq[OF _ _ IH'] by simp
 qed
 
 subsection\<open>Lemma IV.2.40(b)\<close>
   (* Lemma IV.2.40(b), membership *)
 lemma IV240b_mem:
   includes some_rules
   assumes
     "val(G,\<pi>)\<in>val(G,\<tau>)" "\<pi>\<in>M" "\<tau>\<in>M"
     and
     IH:"\<And>\<sigma>. \<sigma>\<in>domain(\<tau>) \<Longrightarrow> val(G,\<pi>) = val(G,\<sigma>) \<Longrightarrow>
       \<exists>p\<in>G. p forces\<^sub>a (\<pi> = \<sigma>)" (* inductive hypothesis *)
   shows
     "\<exists>p\<in>G. p forces\<^sub>a (\<pi> \<in> \<tau>)"
 proof -
   from \<open>val(G,\<pi>)\<in>val(G,\<tau>)\<close>
   obtain \<sigma> r where "r\<in>G" "\<langle>\<sigma>,r\<rangle>\<in>\<tau>" "val(G,\<pi>) = val(G,\<sigma>)" by auto
   moreover from this and IH
   obtain p' where "p'\<in>G" "p' forces\<^sub>a (\<pi> = \<sigma>)" by blast
   ultimately
   obtain p where "p\<preceq>r" "p\<preceq>p'" "p\<in>G" "p forces\<^sub>a (\<pi> = \<sigma>)"
     using M_generic_compatD strengthening_eq[of p'] M_genericD by auto
   moreover from calculation
-  have "q forces\<^sub>a (\<pi> = \<sigma>)" if "q\<in>P" "q\<preceq>p" for q
+  have "q forces\<^sub>a (\<pi> = \<sigma>)" if "q\<in>\<bbbP>" "q\<preceq>p" for q
     using that strengthening_eq by blast
   moreover
   note \<open>\<langle>\<sigma>,r\<rangle>\<in>\<tau>\<close> \<open>r\<in>G\<close>
   ultimately
-  have "r\<in>P \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)" if "q\<in>P" "q\<preceq>p" for q
+  have "r\<in>\<bbbP> \<and> \<langle>\<sigma>,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = \<sigma>)" if "q\<in>\<bbbP>" "q\<preceq>p" for q
     using that leq_transD[of _ p r] by blast
   then
-  have "dense_below({q\<in>P. \<exists>s r. r\<in>P \<and> \<langle>s,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = s)},p)"
+  have "dense_below({q\<in>\<bbbP>. \<exists>s r. r\<in>\<bbbP> \<and> \<langle>s,r\<rangle> \<in> \<tau> \<and> q\<preceq>r \<and> q forces\<^sub>a (\<pi> = s)},p)"
     using refl_leq by blast
   moreover
   note \<open>p\<in>G\<close>
   moreover from calculation
   have "p forces\<^sub>a (\<pi> \<in> \<tau>)"
     using forces_mem_iff_dense_below by blast
   ultimately
   show ?thesis by blast
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 context forcing_data1
 begin
 
 lemma Collect_forces_eq_in_M:
   assumes "\<tau> \<in> M" "\<theta> \<in> M"
-  shows "{p\<in>P. p forces\<^sub>a (\<tau> = \<theta>)} \<in> M"
-  using assms Collect_in_M[of "forces_eq_fm(1,2,0,3,4)" "[P,leq,\<tau>,\<theta>]"]
+  shows "{p\<in>\<bbbP>. p forces\<^sub>a (\<tau> = \<theta>)} \<in> M"
+  using assms Collect_in_M[of "forces_eq_fm(1,2,0,3,4)" "[\<bbbP>,leq,\<tau>,\<theta>]"]
     arity_forces_eq_fm sats_forces_eq_fm forces_eq_abs forces_eq_fm_type
   by (simp add: union_abs1 Un_commute)
 
 lemma IV240b_eq_Collects:
   assumes "\<tau> \<in> M" "\<theta> \<in> M"
-  shows "{p\<in>P. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)}\<in>M" and
-    "{p\<in>P. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)}\<in>M"
+  shows "{p\<in>\<bbbP>. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)}\<in>M" and
+    "{p\<in>\<bbbP>. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)}\<in>M"
 proof -
   let ?rel_pred="\<lambda>M x a1 a2 a3 a4.
         \<exists>\<sigma>[M]. \<exists>u[M]. \<exists>da3[M]. \<exists>da4[M]. is_domain(M,a3,da3) \<and> is_domain(M,a4,da4) \<and>
           union(M,da3,da4,u) \<and> \<sigma>\<in>u \<and> is_forces_mem'(M,a1,a2,x,\<sigma>,a3) \<and>
           is_forces_nmem'(M,a1,a2,x,\<sigma>,a4)"
   let ?\<phi>="Exists(Exists(Exists(Exists(And(domain_fm(7,1),And(domain_fm(8,0),
           And(union_fm(1,0,2),And(Member(3,2),And(forces_mem_fm(5,6,4,3,7),
                               forces_nmem_fm(5,6,4,3,8))))))))))"
   have 1:"\<sigma>\<in>M" if "\<langle>\<sigma>,y\<rangle>\<in>\<delta>" "\<delta>\<in>M" for \<sigma> \<delta> y
     using that pair_in_M_iff transitivity[of "\<langle>\<sigma>,y\<rangle>" \<delta>] by simp
-  have abs1:"?rel_pred(##M,p,P,leq,\<tau>,\<theta>) \<longleftrightarrow>
-        (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). forces_mem'(P,leq,p,\<sigma>,\<tau>) \<and> forces_nmem'(P,leq,p,\<sigma>,\<theta>))"
+  have abs1:"?rel_pred(##M,p,\<bbbP>,leq,\<tau>,\<theta>) \<longleftrightarrow>
+        (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). forces_mem'(\<bbbP>,leq,p,\<sigma>,\<tau>) \<and> forces_nmem'(\<bbbP>,leq,p,\<sigma>,\<theta>))"
     if "p\<in>M" for p
     unfolding forces_mem_def forces_nmem_def
     using assms that forces_mem'_abs forces_nmem'_abs
       domain_closed Un_closed
     by (auto simp add:1[of _ _ \<tau>] 1[of _ _ \<theta>])
-  have abs2:"?rel_pred(##M,p,P,leq,\<theta>,\<tau>) \<longleftrightarrow> (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>).
-        forces_nmem'(P,leq,p,\<sigma>,\<tau>) \<and> forces_mem'(P,leq,p,\<sigma>,\<theta>))" if "p\<in>M" for p
+  have abs2:"?rel_pred(##M,p,\<bbbP>,leq,\<theta>,\<tau>) \<longleftrightarrow> (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>).
+        forces_nmem'(\<bbbP>,leq,p,\<sigma>,\<tau>) \<and> forces_mem'(\<bbbP>,leq,p,\<sigma>,\<theta>))" if "p\<in>M" for p
     unfolding forces_mem_def forces_nmem_def
     using assms that forces_mem'_abs forces_nmem'_abs
       domain_closed Un_closed
     by (auto simp add:1[of _ _ \<tau>] 1[of _ _ \<theta>])
-  have fsats1:"(M,[p,P,leq,\<tau>,\<theta>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,p,P,leq,\<tau>,\<theta>)" if "p\<in>M" for p
+  have fsats1:"(M,[p,\<bbbP>,leq,\<tau>,\<theta>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,p,\<bbbP>,leq,\<tau>,\<theta>)" if "p\<in>M" for p
     using that assms sats_forces_mem_fm sats_forces_nmem_fm zero_in_M
       domain_closed Un_closed by simp
-  have fsats2:"(M,[p,P,leq,\<theta>,\<tau>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,p,P,leq,\<theta>,\<tau>)" if "p\<in>M" for p
+  have fsats2:"(M,[p,\<bbbP>,leq,\<theta>,\<tau>] \<Turnstile> ?\<phi>) \<longleftrightarrow> ?rel_pred(##M,p,\<bbbP>,leq,\<theta>,\<tau>)" if "p\<in>M" for p
     using that assms sats_forces_mem_fm sats_forces_nmem_fm zero_in_M
       domain_closed Un_closed by simp
   have fty:"?\<phi>\<in>formula" by simp
   have farit:"arity(?\<phi>)=5"
     by (simp add:ord_simp_union arity)
   show
-    "{p \<in> P . \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)} \<in> M"
-    and "{p \<in> P . \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)} \<in> M"
+    "{p \<in> \<bbbP> . \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)} \<in> M"
+    and "{p \<in> \<bbbP> . \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)} \<in> M"
     unfolding forces_mem_def
     using abs1 fty fsats1 farit assms forces_nmem
-      Collect_in_M[of ?\<phi> "[P,leq,\<tau>,\<theta>]"]
+      Collect_in_M[of ?\<phi> "[\<bbbP>,leq,\<tau>,\<theta>]"]
     using abs2 fty fsats2 farit assms forces_nmem domain_closed Un_closed
-      Collect_in_M[of ?\<phi> "[P,leq,\<theta>,\<tau>]"]
+      Collect_in_M[of ?\<phi> "[\<bbbP>,leq,\<theta>,\<tau>]"]
     by simp_all
 qed
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 context G_generic1
 begin
 
 (* Lemma IV.2.40(b), equality *)
 lemma IV240b_eq:
   includes some_rules
   assumes
     "val(G,\<tau>) = val(G,\<theta>)" "\<tau>\<in>M" "\<theta>\<in>M"
     and
     IH:"\<And>\<sigma>. \<sigma>\<in>domain(\<tau>)\<union>domain(\<theta>) \<Longrightarrow>
       (val(G,\<sigma>)\<in>val(G,\<tau>) \<longrightarrow> (\<exists>q\<in>G. q forces\<^sub>a (\<sigma> \<in> \<tau>))) \<and>
       (val(G,\<sigma>)\<in>val(G,\<theta>) \<longrightarrow> (\<exists>q\<in>G. q forces\<^sub>a (\<sigma> \<in> \<theta>)))"
     (* inductive hypothesis *)
   shows
     "\<exists>p\<in>G. p forces\<^sub>a (\<tau> = \<theta>)"
 proof -
-  let ?D1="{p\<in>P. p forces\<^sub>a (\<tau> = \<theta>)}"
-  let ?D2="{p\<in>P. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)}"
-  let ?D3="{p\<in>P. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)}"
+  let ?D1="{p\<in>\<bbbP>. p forces\<^sub>a (\<tau> = \<theta>)}"
+  let ?D2="{p\<in>\<bbbP>. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)}"
+  let ?D3="{p\<in>\<bbbP>. \<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)}"
   let ?D="?D1 \<union> ?D2 \<union> ?D3"
   note assms
   moreover from this
   have "domain(\<tau>) \<union> domain(\<theta>)\<in>M" (is "?B\<in>M") using domain_closed Un_closed by auto
   moreover from calculation
   have "?D2\<in>M" and "?D3\<in>M" using IV240b_eq_Collects by simp_all
   ultimately
   have "?D\<in>M" using Collect_forces_eq_in_M Un_closed by auto
   moreover
   have "dense(?D)"
   proof
     fix p
-    assume "p\<in>P"
-    have "\<exists>d\<in>P. (d forces\<^sub>a (\<tau> = \<theta>) \<or>
+    assume "p\<in>\<bbbP>"
+    have "\<exists>d\<in>\<bbbP>. (d forces\<^sub>a (\<tau> = \<theta>) \<or>
             (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). d forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> d forces\<^sub>a (\<sigma> \<notin> \<theta>)) \<or>
             (\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). d forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> d forces\<^sub>a (\<sigma> \<in> \<theta>))) \<and>
            d \<preceq> p"
     proof (cases "p forces\<^sub>a (\<tau> = \<theta>)")
       case True
-      with \<open>p\<in>P\<close>
+      with \<open>p\<in>\<bbbP>\<close>
       show ?thesis using refl_leq by blast
     next
       case False
-      moreover note \<open>p\<in>P\<close>
+      moreover note \<open>p\<in>\<bbbP>\<close>
       moreover from calculation
-      obtain \<sigma> q where "\<sigma>\<in>domain(\<tau>)\<union>domain(\<theta>)" "q\<in>P" "q\<preceq>p"
+      obtain \<sigma> q where "\<sigma>\<in>domain(\<tau>)\<union>domain(\<theta>)" "q\<in>\<bbbP>" "q\<preceq>p"
         "(q forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> \<not> q forces\<^sub>a (\<sigma> \<in> \<theta>)) \<or>
          (\<not> q forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> q forces\<^sub>a (\<sigma> \<in> \<theta>))"
         using def_forces_eq by blast
       moreover from this
-      obtain r where "r\<preceq>q" "r\<in>P"
+      obtain r where "r\<preceq>q" "r\<in>\<bbbP>"
         "(r forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> r forces\<^sub>a (\<sigma> \<notin> \<theta>)) \<or>
          (r forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> r forces\<^sub>a (\<sigma> \<in> \<theta>))"
         using not_forces_nmem strengthening_mem by blast
       ultimately
       show ?thesis using leq_transD by blast
     qed
     then
     show "\<exists>d\<in>?D . d \<preceq> p" by blast
   qed
   moreover
-  have "?D \<subseteq> P"
+  have "?D \<subseteq> \<bbbP>"
     by auto
   ultimately
   obtain p where "p\<in>G" "p\<in>?D"
     using M_generic_denseD[of ?D] by blast
   then
   consider
     (1) "p forces\<^sub>a (\<tau> = \<theta>)" |
     (2) "\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<in> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<notin> \<theta>)" |
     (3) "\<exists>\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>). p forces\<^sub>a (\<sigma> \<notin> \<tau>) \<and> p forces\<^sub>a (\<sigma> \<in> \<theta>)"
     by blast
   then
   show ?thesis
   proof (cases)
     case 1
     with \<open>p\<in>G\<close>
     show ?thesis by blast
   next
     case 2
     then
     obtain \<sigma> where "\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)" "p forces\<^sub>a (\<sigma> \<in> \<tau>)" "p forces\<^sub>a (\<sigma> \<notin> \<theta>)"
       by blast
     moreover from this and \<open>p\<in>G\<close> and assms
     have "val(G,\<sigma>)\<in>val(G,\<tau>)"
       using IV240a[of \<sigma> \<tau>] transitivity[OF _ domain_closed[simplified]] by force
     moreover note \<open>val(G,\<tau>) = _\<close>
     ultimately
     obtain q where "q\<in>G" "q forces\<^sub>a (\<sigma> \<in> \<theta>)" 
       using IH[OF \<open>\<sigma>\<in>_\<close>]
       by auto
     moreover from this and \<open>p\<in>G\<close>
-    obtain r where "r\<in>P" "r\<preceq>p" "r\<preceq>q"
+    obtain r where "r\<in>\<bbbP>" "r\<preceq>p" "r\<preceq>q"
       by blast
     ultimately
     have "r forces\<^sub>a (\<sigma> \<in> \<theta>)"
       using strengthening_mem by blast
-    with \<open>r\<preceq>p\<close> \<open>p forces\<^sub>a (\<sigma> \<notin> \<theta>)\<close> \<open>r\<in>P\<close>
+    with \<open>r\<preceq>p\<close> \<open>p forces\<^sub>a (\<sigma> \<notin> \<theta>)\<close> \<open>r\<in>\<bbbP>\<close>
     have "False"
       unfolding forces_nmem_def by blast
     then
     show ?thesis by simp
   next (* copy-paste from case 2 mutatis mutandis*)
     case 3
     then
     obtain \<sigma> where "\<sigma>\<in>domain(\<tau>) \<union> domain(\<theta>)" "p forces\<^sub>a (\<sigma> \<in> \<theta>)" "p forces\<^sub>a (\<sigma> \<notin> \<tau>)"
       by blast
     moreover from this and \<open>p\<in>G\<close> and assms
     have "val(G,\<sigma>)\<in>val(G,\<theta>)"
       using IV240a[of \<sigma> \<theta>] transitivity[OF _ domain_closed[simplified]] by force
     moreover note \<open>val(G,\<tau>) = _\<close>
     ultimately
     obtain q where "q\<in>G" "q forces\<^sub>a (\<sigma> \<in> \<tau>)" 
       using IH[OF \<open>\<sigma>\<in>_\<close>]
       by auto
     moreover from this and \<open>p\<in>G\<close>
-    obtain r where "r\<in>P" "r\<preceq>p" "r\<preceq>q"
+    obtain r where "r\<in>\<bbbP>" "r\<preceq>p" "r\<preceq>q"
       by blast
     ultimately
     have "r forces\<^sub>a (\<sigma> \<in> \<tau>)"
       using strengthening_mem by blast
-    with \<open>r\<preceq>p\<close> \<open>p forces\<^sub>a (\<sigma> \<notin> \<tau>)\<close> \<open>r\<in>P\<close>
+    with \<open>r\<preceq>p\<close> \<open>p forces\<^sub>a (\<sigma> \<notin> \<tau>)\<close> \<open>r\<in>\<bbbP>\<close>
     have "False"
       unfolding forces_nmem_def by blast
     then
     show ?thesis by simp
   qed
 qed
 
 (* Lemma IV.2.40(b), full *)
 lemma IV240b:
     "(\<tau>\<in>M\<longrightarrow>\<theta>\<in>M\<longrightarrow>val(G,\<tau>) = val(G,\<theta>) \<longrightarrow> (\<exists>p\<in>G. p forces\<^sub>a (\<tau> = \<theta>))) \<and>
      (\<tau>\<in>M\<longrightarrow>\<theta>\<in>M\<longrightarrow>val(G,\<tau>) \<in> val(G,\<theta>) \<longrightarrow> (\<exists>p\<in>G. p forces\<^sub>a (\<tau> \<in> \<theta>)))"
     (is "?Q(\<tau>,\<theta>) \<and> ?R(\<tau>,\<theta>)")
 proof (intro forces_induction)
   fix \<tau> \<theta> p
   assume "\<sigma>\<in>domain(\<theta>) \<Longrightarrow> ?Q(\<tau>, \<sigma>)" for \<sigma>
   then  show "?R(\<tau>, \<theta>)"
     using IV240b_mem domain_closed transitivity by simp
 next
   fix \<tau> \<theta> p
   assume "\<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow> ?R(\<sigma>,\<tau>) \<and> ?R(\<sigma>,\<theta>)" for \<sigma>
   moreover from this
   have IH':"\<tau>\<in>M \<Longrightarrow> \<theta>\<in>M \<Longrightarrow> \<sigma> \<in> domain(\<tau>) \<union> domain(\<theta>) \<Longrightarrow>
           (val(G, \<sigma>) \<in> val(G, \<tau>) \<longrightarrow> (\<exists>q\<in>G. q forces\<^sub>a (\<sigma> \<in> \<tau>))) \<and>
           (val(G, \<sigma>) \<in> val(G, \<theta>) \<longrightarrow> (\<exists>q\<in>G. q forces\<^sub>a (\<sigma> \<in> \<theta>)))" for \<sigma>
     using domain_trans[OF trans_M]
     by blast
   ultimately
   show "?Q(\<tau>,\<theta>)"
     using IV240b_eq by auto
 qed
 
 lemma truth_lemma_mem:
   assumes
     "env\<in>list(M)"
     "n\<in>nat" "m\<in>nat" "n<length(env)" "m<length(env)"
   shows
     "(\<exists>p\<in>G. p \<tturnstile> Member(n,m) env)  \<longleftrightarrow>  M[G], map(val(G),env) \<Turnstile> Member(n,m)"
   using assms IV240a[of "nth(n,env)" "nth(m,env)"]
     IV240b[of "nth(n,env)" "nth(m,env)"]
     M_genericD
     Forces_Member[of _  "nth(n,env)" "nth(m,env)" env n m] map_val_in_MG
   by auto
 
 lemma truth_lemma_eq:
   assumes
     "env\<in>list(M)"
     "n\<in>nat" "m\<in>nat" "n<length(env)" "m<length(env)"
   shows
     "(\<exists>p\<in>G. p \<tturnstile> Equal(n,m) env)  \<longleftrightarrow>  M[G], map(val(G),env) \<Turnstile> Equal(n,m)"
   using assms IV240a(1)[of "nth(n,env)" "nth(m,env)"]
     IV240b(1)[of "nth(n,env)" "nth(m,env)"]
     M_genericD
     Forces_Equal[of _  "nth(n,env)" "nth(m,env)" env n m] map_val_in_MG
   by auto
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 lemma arities_at_aux:
   assumes
     "n \<in> nat" "m \<in> nat" "env \<in> list(M)" "succ(n) \<union> succ(m) \<le> length(env)"
   shows
     "n < length(env)" "m < length(env)"
   using assms succ_leE[OF Un_leD1, of n "succ(m)" "length(env)"]
     succ_leE[OF Un_leD2, of "succ(n)" m "length(env)"] by auto
 
 subsection\<open>The Strenghtening Lemma\<close>
 
 context forcing_data1
 begin
 
 lemma strengthening_lemma:
   assumes
-    "p\<in>P" "\<phi>\<in>formula" "r\<in>P" "r\<preceq>p"
+    "p\<in>\<bbbP>" "\<phi>\<in>formula" "r\<in>\<bbbP>" "r\<preceq>p"
     "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
   shows
     "p \<tturnstile> \<phi> env \<Longrightarrow> r \<tturnstile> \<phi> env"
   using assms(2-)
 proof (induct arbitrary:env)
   case (Member n m)
   then
   have "n<length(env)" "m<length(env)"
     using arities_at_aux by simp_all
   moreover
   assume "env\<in>list(M)"
   moreover
   note assms Member
   ultimately
   show ?case
     using Forces_Member[of _ "nth(n,env)" "nth(m,env)" env n m]
       strengthening_mem[of p r "nth(n,env)" "nth(m,env)"] by simp
 next
   case (Equal n m)
   then
   have "n<length(env)" "m<length(env)"
     using arities_at_aux by simp_all
   moreover
   assume "env\<in>list(M)"
   moreover
   note assms Equal
   ultimately
   show ?case
     using Forces_Equal[of _ "nth(n,env)" "nth(m,env)" env n m]
       strengthening_eq[of p r "nth(n,env)" "nth(m,env)"] by simp
 next
   case (Nand \<phi> \<psi>)
   with assms
   show ?case
     using Forces_Nand transitivity[OF _ P_in_M] pair_in_M_iff
       transitivity[OF _ leq_in_M] leq_transD by auto
 next
   case (Forall \<phi>)
   with assms
   have "p \<tturnstile> \<phi> ([x] @ env)" if "x\<in>M" for x
     using that Forces_Forall by simp
   with Forall
   have "r \<tturnstile> \<phi> ([x] @ env)" if "x\<in>M" for x
     using that pred_le2 by (simp)
   with assms Forall
   show ?case
     using Forces_Forall by simp
 qed
 
 subsection\<open>The Density Lemma\<close>
 
 lemma arity_Nand_le:
   assumes "\<phi> \<in> formula" "\<psi> \<in> formula" "arity(Nand(\<phi>, \<psi>)) \<le> length(env)" "env\<in>list(A)"
   shows "arity(\<phi>) \<le> length(env)" "arity(\<psi>) \<le> length(env)"
   using assms
   by (rule_tac Un_leD1, rule_tac [5] Un_leD2, auto)
 
 lemma dense_below_imp_forces:
   assumes
-    "p\<in>P" "\<phi>\<in>formula"
+    "p\<in>\<bbbP>" "\<phi>\<in>formula"
     "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
   shows
-    "dense_below({q\<in>P. (q \<tturnstile> \<phi> env)},p) \<Longrightarrow> (p \<tturnstile> \<phi> env)"
+    "dense_below({q\<in>\<bbbP>. (q \<tturnstile> \<phi> env)},p) \<Longrightarrow> (p \<tturnstile> \<phi> env)"
   using assms(2-)
 proof (induct arbitrary:env)
   case (Member n m)
   then
   have "n<length(env)" "m<length(env)"
     using arities_at_aux by simp_all
   moreover
   assume "env\<in>list(M)"
   moreover
   note assms Member
   ultimately
   show ?case
     using Forces_Member[of _ "nth(n,env)" "nth(m,env)" env n m]
       density_mem[of p "nth(n,env)" "nth(m,env)"] by simp
 next
   case (Equal n m)
   then
   have "n<length(env)" "m<length(env)"
     using arities_at_aux by simp_all
   moreover
   assume "env\<in>list(M)"
   moreover
   note assms Equal
   ultimately
   show ?case
     using Forces_Equal[of _ "nth(n,env)" "nth(m,env)" env n m]
       density_eq[of p "nth(n,env)" "nth(m,env)"] by simp
 next
   case (Nand \<phi> \<psi>)
   {
     fix q
-    assume "q\<in>M" "q\<in>P" "q\<preceq> p" "q \<tturnstile> \<phi> env"
+    assume "q\<in>M" "q\<in>\<bbbP>" "q\<preceq> p" "q \<tturnstile> \<phi> env"
     moreover
     note Nand
     moreover from calculation
-    obtain d where "d\<in>P" "d \<tturnstile> Nand(\<phi>, \<psi>) env" "d\<preceq> q"
+    obtain d where "d\<in>\<bbbP>" "d \<tturnstile> Nand(\<phi>, \<psi>) env" "d\<preceq> q"
       using dense_belowI by auto
     moreover from calculation
     have "\<not>(d\<tturnstile> \<psi> env)" if "d \<tturnstile> \<phi> env"
       using that Forces_Nand refl_leq transitivity[OF _ P_in_M, of d] by auto
     moreover
     note arity_Nand_le[of \<phi> \<psi>]
     moreover from calculation
     have "d \<tturnstile> \<phi> env"
       using strengthening_lemma[of q \<phi> d env] Un_leD1 by auto
     ultimately
     have "\<not> (q \<tturnstile> \<psi> env)"
       using strengthening_lemma[of q \<psi> d env] by auto
   }
-  with \<open>p\<in>P\<close>
+  with \<open>p\<in>\<bbbP>\<close>
   show ?case
     using Forces_Nand[symmetric, OF _ Nand(6,1,3)] by blast
 next
   case (Forall \<phi>)
-  have "dense_below({q\<in>P. q \<tturnstile> \<phi> ([a]@env)},p)" if "a\<in>M" for a
+  have "dense_below({q\<in>\<bbbP>. q \<tturnstile> \<phi> ([a]@env)},p)" if "a\<in>M" for a
   proof
     fix r
-    assume "r\<in>P" "r\<preceq>p"
+    assume "r\<in>\<bbbP>" "r\<preceq>p"
     with \<open>dense_below(_,p)\<close>
-    obtain q where "q\<in>P" "q\<preceq>r" "q \<tturnstile> Forall(\<phi>) env"
+    obtain q where "q\<in>\<bbbP>" "q\<preceq>r" "q \<tturnstile> Forall(\<phi>) env"
       by blast
     moreover
     note Forall \<open>a\<in>M\<close>
     moreover from calculation
     have "q \<tturnstile> \<phi> ([a]@env)"
       using Forces_Forall by simp
     ultimately
-    show "\<exists>d \<in> {q\<in>P. q \<tturnstile> \<phi> ([a]@env)}. d \<in> P \<and> d\<preceq>r"
+    show "\<exists>d \<in> {q\<in>\<bbbP>. q \<tturnstile> \<phi> ([a]@env)}. d \<in> \<bbbP> \<and> d\<preceq>r"
       by auto
   qed
   moreover
   note Forall(2)[of "Cons(_,env)"] Forall(1,3-5)
   ultimately
   have "p \<tturnstile> \<phi> ([a]@env)" if "a\<in>M" for a
     using that pred_le2 by simp
   with assms Forall
   show ?case using Forces_Forall by simp
 qed
 
 lemma density_lemma:
   assumes
-    "p\<in>P" "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
+    "p\<in>\<bbbP>" "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
   shows
-    "p \<tturnstile> \<phi> env   \<longleftrightarrow>   dense_below({q\<in>P. (q \<tturnstile> \<phi> env)},p)"
+    "p \<tturnstile> \<phi> env   \<longleftrightarrow>   dense_below({q\<in>\<bbbP>. (q \<tturnstile> \<phi> env)},p)"
 proof
-  assume "dense_below({q\<in>P. (q \<tturnstile> \<phi> env)},p)"
+  assume "dense_below({q\<in>\<bbbP>. (q \<tturnstile> \<phi> env)},p)"
   with assms
   show  "(p \<tturnstile> \<phi> env)"
     using dense_below_imp_forces by simp
 next
   assume "p \<tturnstile> \<phi> env"
   with assms
-  show "dense_below({q\<in>P. q \<tturnstile> \<phi> env},p)"
+  show "dense_below({q\<in>\<bbbP>. q \<tturnstile> \<phi> env},p)"
     using strengthening_lemma refl_leq by auto
 qed
 
 subsection\<open>The Truth Lemma\<close>
 
 lemma Forces_And:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
     "arity(\<phi>) \<le> length(env)" "arity(\<psi>) \<le> length(env)"
   shows
     "p \<tturnstile> And(\<phi>,\<psi>) env   \<longleftrightarrow>  (p \<tturnstile> \<phi> env) \<and> (p \<tturnstile> \<psi> env)"
 proof
   assume "p \<tturnstile> And(\<phi>, \<psi>) env"
   with assms
-  have "dense_below({r \<in> P . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}, p)"
+  have "dense_below({r \<in> \<bbbP> . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}, p)"
     using Forces_And_iff_dense_below by simp
   then
-  have "dense_below({r \<in> P . (r \<tturnstile> \<phi> env)}, p)" "dense_below({r \<in> P . (r \<tturnstile> \<psi> env)}, p)"
+  have "dense_below({r \<in> \<bbbP> . (r \<tturnstile> \<phi> env)}, p)" "dense_below({r \<in> \<bbbP> . (r \<tturnstile> \<psi> env)}, p)"
     by blast+
   with assms
   show "(p \<tturnstile> \<phi> env) \<and> (p \<tturnstile> \<psi> env)"
     using density_lemma[symmetric] by simp
 next
   assume "(p \<tturnstile> \<phi> env) \<and> (p \<tturnstile> \<psi> env)"
-  have "dense_below({r \<in> P . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}, p)"
+  have "dense_below({r \<in> \<bbbP> . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}, p)"
   proof (intro dense_belowI bexI conjI, assumption)
     fix q
-    assume "q\<in>P" "q\<preceq> p"
+    assume "q\<in>\<bbbP>" "q\<preceq> p"
     with assms \<open>(p \<tturnstile> \<phi> env) \<and> (p \<tturnstile> \<psi> env)\<close>
-    show "q\<in>{r \<in> P . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}" "q\<preceq> q"
+    show "q\<in>{r \<in> \<bbbP> . (r \<tturnstile> \<phi> env) \<and> (r \<tturnstile> \<psi> env)}" "q\<preceq> q"
       using strengthening_lemma refl_leq by auto
   qed
   with assms
   show "p \<tturnstile> And(\<phi>,\<psi>) env"
     using Forces_And_iff_dense_below by simp
 qed
 
 lemma Forces_Nand_alt:
   assumes
-    "p\<in>P" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
+    "p\<in>\<bbbP>" "env \<in> list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
     "arity(\<phi>) \<le> length(env)" "arity(\<psi>) \<le> length(env)"
   shows
     "(p \<tturnstile> Nand(\<phi>,\<psi>) env) \<longleftrightarrow> (p \<tturnstile> Neg(And(\<phi>,\<psi>)) env)"
   using assms Forces_Nand Forces_And Forces_Neg by auto
 
 end
 
 context G_generic1
 begin
 
 lemma  truth_lemma_Neg:
   assumes
     "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>)\<le>length(env)" and
     IH: "(\<exists>p\<in>G. p \<tturnstile> \<phi> env) \<longleftrightarrow> M[G], map(val(G),env) \<Turnstile> \<phi>"
   shows
     "(\<exists>p\<in>G. p \<tturnstile> Neg(\<phi>) env)  \<longleftrightarrow>  M[G], map(val(G),env) \<Turnstile> Neg(\<phi>)"
 proof (intro iffI, elim bexE, rule ccontr)
   (* Direct implication by contradiction *)
   fix p
   assume "p\<in>G" "p \<tturnstile> Neg(\<phi>) env" "\<not>(M[G],map(val(G),env) \<Turnstile> Neg(\<phi>))"
   moreover
   note assms
   moreover from calculation
-  have "M[G], map(val(G),env) \<Turnstile> \<phi>" "p\<in>P"
+  have "M[G], map(val(G),env) \<Turnstile> \<phi>" "p\<in>\<bbbP>"
     using map_val_in_MG by auto
   with IH
-  obtain r where "r \<tturnstile> \<phi> env" "r\<in>G" "r\<in>P" by blast
+  obtain r where "r \<tturnstile> \<phi> env" "r\<in>G" "r\<in>\<bbbP>" by blast
   moreover from this and \<open>p\<in>G\<close>
-  obtain q where "q\<preceq>p" "q\<preceq>r" "q\<in>G" "q\<in>P" "q\<in>M"
+  obtain q where "q\<preceq>p" "q\<preceq>r" "q\<in>G" "q\<in>\<bbbP>" "q\<in>M"
     using transitivity[OF _ P_in_M]
     by blast
   moreover from calculation
   have "q \<tturnstile> \<phi> env"
     using strengthening_lemma
     by simp
-  with assms \<open>p \<tturnstile> _ _\<close> \<open>q\<preceq>p\<close> \<open>q\<in>M\<close> \<open>p\<in>P\<close> \<open>q\<in>P\<close>
+  with assms \<open>p \<tturnstile> _ _\<close> \<open>q\<preceq>p\<close> \<open>q\<in>M\<close> \<open>p\<in>\<bbbP>\<close> \<open>q\<in>\<bbbP>\<close>
    show "False"
     using Forces_Neg
     by auto
 next
   assume "M[G], map(val(G),env) \<Turnstile> Neg(\<phi>)"
   with assms
   have "\<not> (M[G], map(val(G),env) \<Turnstile> \<phi>)"
     using map_val_in_MG by simp
-  let ?D="{p\<in>P. (p \<tturnstile> \<phi> env) \<or> (p \<tturnstile> Neg(\<phi>) env)}"
+  let ?D="{p\<in>\<bbbP>. (p \<tturnstile> \<phi> env) \<or> (p \<tturnstile> Neg(\<phi>) env)}"
   from assms
   have "?D \<in> M"
     using separation_disj separation_closed separation_forces by simp
   moreover
-  have "?D \<subseteq> P" by auto
+  have "?D \<subseteq> \<bbbP>" by auto
   moreover
   have "dense(?D)"
   proof
     fix q
-    assume "q\<in>P"
+    assume "q\<in>\<bbbP>"
     with assms
-    show "\<exists>d\<in>{p \<in> P . (p \<tturnstile> \<phi> env) \<or> (p \<tturnstile> Neg(\<phi>) env)}. d\<preceq> q"
+    show "\<exists>d\<in>{p \<in> \<bbbP> . (p \<tturnstile> \<phi> env) \<or> (p \<tturnstile> Neg(\<phi>) env)}. d\<preceq> q"
       using refl_leq Forces_Neg by (cases "q \<tturnstile> Neg(\<phi>) env", auto)
   qed
   ultimately
   obtain p where "p\<in>G" "(p \<tturnstile> \<phi> env) \<or> (p \<tturnstile> Neg(\<phi>) env)"
     by blast
   then
   consider (1) "p \<tturnstile> \<phi> env" | (2) "p \<tturnstile> Neg(\<phi>) env" by blast
   then
   show "\<exists>p\<in>G. (p \<tturnstile> Neg(\<phi>) env)"
   proof (cases)
     case 1
     with \<open>\<not> (M[G],map(val(G),env) \<Turnstile> \<phi>)\<close> \<open>p\<in>G\<close> IH
     show ?thesis
       by blast
   next
     case 2
     with \<open>p\<in>G\<close>
     show ?thesis by blast
   qed
 qed
 
 lemma truth_lemma_And:
   assumes
     "env\<in>list(M)" "\<phi>\<in>formula" "\<psi>\<in>formula"
     "arity(\<phi>)\<le>length(env)" "arity(\<psi>) \<le> length(env)"
     and
     IH: "(\<exists>p\<in>G. p \<tturnstile> \<phi> env)  \<longleftrightarrow>   M[G], map(val(G),env) \<Turnstile> \<phi>"
     "(\<exists>p\<in>G. p \<tturnstile> \<psi> env)  \<longleftrightarrow>   M[G], map(val(G),env) \<Turnstile> \<psi>"
   shows
     "(\<exists>p\<in>G. (p \<tturnstile> And(\<phi>,\<psi>) env)) \<longleftrightarrow> M[G] , map(val(G),env) \<Turnstile> And(\<phi>,\<psi>)"
   using assms map_val_in_MG Forces_And[OF M_genericD assms(1-5)]
 proof (intro iffI, elim bexE)
   fix p
   assume "p\<in>G" "p \<tturnstile> And(\<phi>,\<psi>) env"
   with assms
   show "M[G], map(val(G),env) \<Turnstile> And(\<phi>,\<psi>)"
     using Forces_And[of  _ _ \<phi> \<psi>] map_val_in_MG M_genericD by auto
 next
   assume "M[G], map(val(G),env) \<Turnstile> And(\<phi>,\<psi>)"
   moreover
   note assms
   moreover from calculation
-  obtain q r where "q \<tturnstile> \<phi> env" "r \<tturnstile> \<psi> env" "q\<in>G" "r\<in>G" "r\<in>P" "q\<in>P"
+  obtain q r where "q \<tturnstile> \<phi> env" "r \<tturnstile> \<psi> env" "q\<in>G" "r\<in>G" "r\<in>\<bbbP>" "q\<in>\<bbbP>"
     using map_val_in_MG Forces_And[OF M_genericD assms(1-5)] M_genericD by auto
   moreover from calculation
   obtain p where "p\<preceq>q" "p\<preceq>r" "p\<in>G"
     by auto
   moreover from calculation
   have "(p \<tturnstile> \<phi> env) \<and> (p \<tturnstile> \<psi> env)" (* can't solve as separate goals *)
     using strengthening_lemma[OF M_genericD] by force
   ultimately
   show "\<exists>p\<in>G. (p \<tturnstile> And(\<phi>,\<psi>) env)"
     using Forces_And[OF M_genericD assms(1-5)] by auto
 qed
 
 end
 
 definition
   ren_truth_lemma :: "i\<Rightarrow>i" where
   "ren_truth_lemma(\<phi>) \<equiv>
     Exists(Exists(Exists(Exists(Exists(
     And(Equal(0,5),And(Equal(1,8),And(Equal(2,9),And(Equal(3,10),And(Equal(4,6),
     iterates(\<lambda>p. incr_bv(p)`5 , 6, \<phi>)))))))))))"
 
 lemma ren_truth_lemma_type[TC] :
   "\<phi>\<in>formula \<Longrightarrow> ren_truth_lemma(\<phi>) \<in>formula"
   unfolding ren_truth_lemma_def
   by simp
 
 lemma arity_ren_truth :
   assumes "\<phi>\<in>formula"
   shows "arity(ren_truth_lemma(\<phi>)) \<le> 6 \<union> succ(arity(\<phi>))"
 proof -
   consider (lt) "5 <arity(\<phi>)" | (ge) "\<not> 5 < arity(\<phi>)"
     by auto
   then
   show ?thesis
   proof cases
     case lt
     consider (a) "5<arity(\<phi>)+\<^sub>\<omega>5"  | (b) "arity(\<phi>)+\<^sub>\<omega>5 \<le> 5"
       using not_lt_iff_le \<open>\<phi>\<in>_\<close> by force
     then
     show ?thesis
     proof cases
       case a
       with \<open>\<phi>\<in>_\<close> lt
       have "5 < succ(arity(\<phi>))" "5<arity(\<phi>)+\<^sub>\<omega>2"  "5<arity(\<phi>)+\<^sub>\<omega>3"  "5<arity(\<phi>)+\<^sub>\<omega>4"
         using succ_ltI by auto
       with \<open>\<phi>\<in>_\<close>
       have c:"arity(iterates(\<lambda>p. incr_bv(p)`5,5,\<phi>)) = 5+\<^sub>\<omega>arity(\<phi>)" (is "arity(?\<phi>') = _")
         using arity_incr_bv_lemma lt a
         by simp
       with \<open>\<phi>\<in>_\<close>
       have "arity(incr_bv(?\<phi>')`5) = 6+\<^sub>\<omega>arity(\<phi>)"
         using arity_incr_bv_lemma[of ?\<phi>' 5] a by auto
       with \<open>\<phi>\<in>_\<close>
       show ?thesis
         unfolding ren_truth_lemma_def
         using pred_Un_distrib union_abs1 Un_assoc[symmetric] a c union_abs2
         by (simp add:arity)
     next
       case b
       with \<open>\<phi>\<in>_\<close> lt
       have "5 < succ(arity(\<phi>))" "5<arity(\<phi>)+\<^sub>\<omega>2"  "5<arity(\<phi>)+\<^sub>\<omega>3"  "5<arity(\<phi>)+\<^sub>\<omega>4" "5<arity(\<phi>)+\<^sub>\<omega>5"
         using succ_ltI by auto
       with \<open>\<phi>\<in>_\<close>
       have "arity(iterates(\<lambda>p. incr_bv(p)`5,6,\<phi>)) = 6+\<^sub>\<omega>arity(\<phi>)" (is "arity(?\<phi>') = _")
         using arity_incr_bv_lemma lt
         by simp
       with \<open>\<phi>\<in>_\<close>
       show ?thesis
         unfolding ren_truth_lemma_def
         using pred_Un_distrib union_abs1 Un_assoc[symmetric]  union_abs2
         by (simp add:arity)
     qed
   next
     case ge
     with \<open>\<phi>\<in>_\<close>
     have "arity(\<phi>) \<le> 5" "pred^5(arity(\<phi>)) \<le> 5"
       using not_lt_iff_le le_trans[OF le_pred]
       by auto
     with \<open>\<phi>\<in>_\<close>
     have "arity(iterates(\<lambda>p. incr_bv(p)`5,6,\<phi>)) = arity(\<phi>)" "arity(\<phi>)\<le>6" "pred^5(arity(\<phi>)) \<le> 6"
       using arity_incr_bv_lemma ge le_trans[OF \<open>arity(\<phi>)\<le>5\<close>] le_trans[OF \<open>pred^5(arity(\<phi>))\<le>5\<close>]
       by auto
     with \<open>arity(\<phi>) \<le> 5\<close> \<open>\<phi>\<in>_\<close> \<open>pred^5(_) \<le> 5\<close>
     show ?thesis
       unfolding ren_truth_lemma_def
       using  pred_Un_distrib union_abs1 Un_assoc[symmetric] union_abs2
       by (simp add:arity)
   qed
 qed
 
 lemma sats_ren_truth_lemma:
   "[q,b,d,a1,a2,a3] @ env \<in> list(M) \<Longrightarrow> \<phi> \<in> formula \<Longrightarrow>
    (M, [q,b,d,a1,a2,a3] @ env \<Turnstile> ren_truth_lemma(\<phi>) ) \<longleftrightarrow>
    (M, [q,a1,a2,a3,b] @ env \<Turnstile> \<phi>)"
   unfolding ren_truth_lemma_def
   by (insert sats_incr_bv_iff [of _ _ M _ "[q,a1,a2,a3,b]"], simp)
 
 context forcing_data1
 begin
 
 lemma truth_lemma' :
   assumes
     "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>) \<le> succ(length(env))"
   shows
-    "separation(##M,\<lambda>d. \<exists>b\<in>M. \<forall>q\<in>P. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env)))"
+    "separation(##M,\<lambda>d. \<exists>b\<in>M. \<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env)))"
 proof -
   let ?rel_pred="\<lambda>M x a1 a2 a3. \<exists>b\<in>M. \<forall>q\<in>M. q\<in>a1 \<and> is_leq(##M,a2,q,x) \<longrightarrow>
                   \<not>(M, [q,a1,a2,a3,b] @ env \<Turnstile> forces(\<phi>))"
   let ?\<psi>="Exists(Forall(Implies(And(Member(0,3),is_leq_fm(4,0,2)),
           Neg(ren_truth_lemma(forces(\<phi>))))))"
-  have "q\<in>M" if "q\<in>P" for q using that transitivity[OF _ P_in_M] by simp
+  have "q\<in>M" if "q\<in>\<bbbP>" for q using that transitivity[OF _ P_in_M] by simp
   then
-  have 1:"\<forall>q\<in>M. q\<in>P \<and> R(q) \<longrightarrow> Q(q) \<Longrightarrow> (\<forall>q\<in>P. R(q) \<longrightarrow> Q(q))" for R Q
+  have 1:"\<forall>q\<in>M. q\<in>\<bbbP> \<and> R(q) \<longrightarrow> Q(q) \<Longrightarrow> (\<forall>q\<in>\<bbbP>. R(q) \<longrightarrow> Q(q))" for R Q
     by auto
   then
-  have "\<lbrakk>b \<in> M; \<forall>q\<in>M. q \<in> P \<and> q \<preceq> d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env))\<rbrakk> \<Longrightarrow>
-         \<exists>c\<in>M. \<forall>q\<in>P. q \<preceq> d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([c]@env))" for b d
+  have "\<lbrakk>b \<in> M; \<forall>q\<in>M. q \<in> \<bbbP> \<and> q \<preceq> d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env))\<rbrakk> \<Longrightarrow>
+         \<exists>c\<in>M. \<forall>q\<in>\<bbbP>. q \<preceq> d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([c]@env))" for b d
     by (rule bexI,simp_all)
   then
-  have "?rel_pred(M,d,P,leq,\<one>) \<longleftrightarrow> (\<exists>b\<in>M. \<forall>q\<in>P. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env)))" if "d\<in>M" for d
+  have "?rel_pred(M,d,\<bbbP>,leq,\<one>) \<longleftrightarrow> (\<exists>b\<in>M. \<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env)))" if "d\<in>M" for d
     using that leq_abs assms
     by auto
   moreover
   have "?\<psi>\<in>formula" using assms by simp
   moreover
-  have "(M, [d,P,leq,\<one>]@env \<Turnstile> ?\<psi>) \<longleftrightarrow> ?rel_pred(M,d,P,leq,\<one>)" if "d\<in>M" for d
+  have "(M, [d,\<bbbP>,leq,\<one>]@env \<Turnstile> ?\<psi>) \<longleftrightarrow> ?rel_pred(M,d,\<bbbP>,leq,\<one>)" if "d\<in>M" for d
     using assms that sats_is_leq_fm sats_ren_truth_lemma zero_in_M
     by simp
   moreover
   have "arity(?\<psi>) \<le> 4+\<^sub>\<omega>length(env)"
   proof -
     have eq:"arity(is_leq_fm(4, 0, 2)) = 5"
       using arity_is_leq_fm succ_Un_distrib ord_simp_union
       by simp
     with \<open>\<phi>\<in>_\<close>
     have "arity(?\<psi>) = 3 \<union> (pred^2(arity(ren_truth_lemma(forces(\<phi>)))))"
       using union_abs1 pred_Un_distrib by (simp add:arity)
     moreover
     have "... \<le> 3 \<union> (pred(pred(6 \<union> succ(arity(forces(\<phi>))))))" (is "_ \<le> ?r")
       using  \<open>\<phi>\<in>_\<close> Un_le_compat[OF le_refl[of 3]]
         le_imp_subset arity_ren_truth[of "forces(\<phi>)"]
         pred_mono
       by auto
     finally
     have "arity(?\<psi>) \<le> ?r" by simp
     have i:"?r \<le> 4 \<union> pred(arity(forces(\<phi>)))"
       using pred_Un_distrib pred_succ_eq \<open>\<phi>\<in>_\<close> Un_assoc[symmetric] union_abs1 by simp
     have h:"4 \<union> pred(arity(forces(\<phi>))) \<le> 4 \<union> (4+\<^sub>\<omega>length(env))"
       using  \<open>env\<in>_\<close> add_commute \<open>\<phi>\<in>_\<close>
         Un_le_compat[of 4 4,OF _ pred_mono[OF _ arity_forces_le[OF _ _ \<open>arity(\<phi>)\<le>_\<close>]] ]
         \<open>env\<in>_\<close> by auto
     with \<open>\<phi>\<in>_\<close> \<open>env\<in>_\<close>
     show ?thesis
       using le_trans[OF  \<open>arity(?\<psi>) \<le> ?r\<close>  le_trans[OF i h]] ord_simp_union by simp
   qed
   ultimately
   show ?thesis using assms
-      separation_ax[of "?\<psi>" "[P,leq,\<one>]@env"]
-      separation_cong[of "##M" "\<lambda>y. (M, [y,P,leq,\<one>]@env \<Turnstile>?\<psi>)"]
+      separation_ax[of "?\<psi>" "[\<bbbP>,leq,\<one>]@env"]
+      separation_cong[of "##M" "\<lambda>y. (M, [y,\<bbbP>,leq,\<one>]@env \<Turnstile>?\<psi>)"]
     by simp
 qed
 
 end
 
 context G_generic1
 begin
 
 lemma truth_lemma:
   assumes
     "\<phi>\<in>formula"
     "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
   shows
     "(\<exists>p\<in>G. p \<tturnstile> \<phi> env)   \<longleftrightarrow>   M[G], map(val(G),env) \<Turnstile> \<phi>"
   using assms
 proof (induct arbitrary:env)
   case (Member x y)
   then
   show ?case
     using truth_lemma_mem[OF \<open>env\<in>list(M)\<close> \<open>x\<in>nat\<close> \<open>y\<in>nat\<close>] arities_at_aux 
     by simp
 next
   case (Equal x y)
   then
   show ?case
     using truth_lemma_eq[OF \<open>env\<in>list(M)\<close> \<open>x\<in>nat\<close> \<open>y\<in>nat\<close>] arities_at_aux by simp
 next
   case (Nand \<phi> \<psi>)
   then
   show ?case
     using truth_lemma_And truth_lemma_Neg[of "\<cdot>\<phi> \<and> \<psi>\<cdot>"] Forces_Nand_alt
       M_genericD map_val_in_MG arity_Nand_le[of \<phi> \<psi>] FOL_arities by auto
 next
   case (Forall \<phi>)
   then
   show ?case
   proof (intro iffI)
     assume "\<exists>p\<in>G. (p \<tturnstile> Forall(\<phi>) env)"
     then
-    obtain p where "p\<in>G" "p\<in>M" "p\<in>P" "p \<tturnstile> Forall(\<phi>) env"
+    obtain p where "p\<in>G" "p\<in>M" "p\<in>\<bbbP>" "p \<tturnstile> Forall(\<phi>) env"
       using transitivity[OF _ P_in_M] by auto
     with \<open>env\<in>list(M)\<close> \<open>\<phi>\<in>formula\<close>
     have "p \<tturnstile> \<phi> ([x]@env)" if "x\<in>M" for x
       using that Forces_Forall by simp
     with \<open>p\<in>G\<close> \<open>\<phi>\<in>formula\<close> \<open>env\<in>_\<close> \<open>arity(Forall(\<phi>)) \<le> length(env)\<close>
       Forall(2)[of "Cons(_,env)"]
     show "M[G], map(val(G),env) \<Turnstile>  Forall(\<phi>)"
       using pred_le2 map_val_in_MG
       by (auto iff:GenExt_iff)
   next
     assume "M[G], map(val(G),env) \<Turnstile> Forall(\<phi>)"
-    let ?D1="{d\<in>P. (d \<tturnstile> Forall(\<phi>) env)}"
-    let ?D2="{d\<in>P. \<exists>b\<in>M. \<forall>q\<in>P. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env))}"
+    let ?D1="{d\<in>\<bbbP>. (d \<tturnstile> Forall(\<phi>) env)}"
+    let ?D2="{d\<in>\<bbbP>. \<exists>b\<in>M. \<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b]@env))}"
     define D where "D \<equiv> ?D1 \<union> ?D2"
     note \<open>arity(Forall(\<phi>)) \<le> length(env)\<close> \<open>\<phi>\<in>formula\<close> \<open>env\<in>list(M)\<close>
     moreover from this
     have ar\<phi>:"arity(\<phi>)\<le>succ(length(env))"
       using pred_le2 by simp
     moreover from calculation
     have "?D1\<in>M" using Collect_forces  by simp
     moreover from \<open>env\<in>list(M)\<close> \<open>\<phi>\<in>formula\<close>
     have "?D2\<in>M"
       using truth_lemma'[of \<phi>] separation_closed ar\<phi>
       by simp
     ultimately
     have "D\<in>M" unfolding D_def using Un_closed by simp
     moreover
-    have "D \<subseteq> P" unfolding D_def by auto
+    have "D \<subseteq> \<bbbP>" unfolding D_def by auto
     moreover
     have "dense(D)"
     proof
       fix p
-      assume "p\<in>P"
+      assume "p\<in>\<bbbP>"
       show "\<exists>d\<in>D. d\<preceq> p"
       proof (cases "p \<tturnstile> Forall(\<phi>) env")
         case True
-        with \<open>p\<in>P\<close>
+        with \<open>p\<in>\<bbbP>\<close>
         show ?thesis unfolding D_def using refl_leq by blast
       next
         case False
-        with Forall \<open>p\<in>P\<close>
+        with Forall \<open>p\<in>\<bbbP>\<close>
         obtain b where "b\<in>M" "\<not>(p \<tturnstile> \<phi> ([b]@env))"
           using Forces_Forall by blast
-        moreover from this \<open>p\<in>P\<close> Forall
-        have "\<not>dense_below({q\<in>P. q \<tturnstile> \<phi> ([b]@env)},p)"
+        moreover from this \<open>p\<in>\<bbbP>\<close> Forall
+        have "\<not>dense_below({q\<in>\<bbbP>. q \<tturnstile> \<phi> ([b]@env)},p)"
           using density_lemma pred_le2  by auto
         moreover from this
-        obtain d where "d\<preceq>p" "\<forall>q\<in>P. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b] @ env))"
-          "d\<in>P" by blast
+        obtain d where "d\<preceq>p" "\<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow> \<not>(q \<tturnstile> \<phi> ([b] @ env))"
+          "d\<in>\<bbbP>" by blast
         ultimately
         show ?thesis unfolding D_def by auto
       qed
     qed
     moreover
     note generic
     ultimately
     obtain d where "d \<in> D" "d \<in> G" by blast
     then
     consider (1) "d\<in>?D1" | (2) "d\<in>?D2" unfolding D_def by blast
     then
     show "\<exists>p\<in>G. (p \<tturnstile> Forall(\<phi>) env)"
     proof (cases)
       case 1
       with \<open>d\<in>G\<close>
       show ?thesis by blast
     next
       case 2
       then
-      obtain b where "b\<in>M" "\<forall>q\<in>P. q\<preceq>d \<longrightarrow>\<not>(q \<tturnstile> \<phi> ([b] @ env))"
+      obtain b where "b\<in>M" "\<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow>\<not>(q \<tturnstile> \<phi> ([b] @ env))"
         by blast
       moreover from this(1) and  \<open>M[G], _ \<Turnstile>  Forall(\<phi>)\<close> and
         Forall(2)[of "Cons(b,env)"] Forall(1,3-)
-      obtain p where "p\<in>G" "p\<in>P" "p \<tturnstile> \<phi> ([b] @ env)"
+      obtain p where "p\<in>G" "p\<in>\<bbbP>" "p \<tturnstile> \<phi> ([b] @ env)"
         using pred_le2 map_val_in_MG M_genericD by (auto iff:GenExt_iff)
       moreover
       note \<open>d\<in>G\<close>
       ultimately
-      obtain q where "q\<in>G" "q\<in>P" "q\<preceq>d" "q\<preceq>p"
+      obtain q where "q\<in>G" "q\<in>\<bbbP>" "q\<preceq>d" "q\<preceq>p"
         using M_genericD by force
       moreover from this and  \<open>p \<tturnstile> \<phi> ([b] @ env)\<close>
-        Forall  \<open>b\<in>M\<close> \<open>p\<in>P\<close>
+        Forall  \<open>b\<in>M\<close> \<open>p\<in>\<bbbP>\<close>
       have "q \<tturnstile> \<phi> ([b] @ env)"
         using pred_le2 strengthening_lemma by simp
       moreover
-      note \<open>\<forall>q\<in>P. q\<preceq>d \<longrightarrow>\<not>(q \<tturnstile> \<phi> ([b] @ env))\<close>
+      note \<open>\<forall>q\<in>\<bbbP>. q\<preceq>d \<longrightarrow>\<not>(q \<tturnstile> \<phi> ([b] @ env))\<close>
       ultimately
       show ?thesis by simp
     qed
   qed
 qed
 
 end
 
 context forcing_data1
 begin
 
 subsection\<open>The ``Definition of forcing''\<close>
 lemma definition_of_forcing:
   assumes
-    "p\<in>P" "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
+    "p\<in>\<bbbP>" "\<phi>\<in>formula" "env\<in>list(M)" "arity(\<phi>)\<le>length(env)"
   shows
     "(p \<tturnstile> \<phi> env) \<longleftrightarrow>
      (\<forall>G. M_generic(G) \<and> p\<in>G \<longrightarrow> M[G], map(val(G),env) \<Turnstile> \<phi>)"
 proof (intro iffI allI impI, elim conjE)
   fix G
   assume "(p \<tturnstile> \<phi> env)" "M_generic(G)" "p \<in> G"
   moreover from this
-  interpret G_generic1 P leq \<one> M enum G 
+  interpret G_generic1 \<bbbP> leq \<one> M enum G 
     by (unfold_locales,simp)
   from calculation assms
   show "M[G], map(val(G),env) \<Turnstile> \<phi>"
     using truth_lemma[of \<phi>] by auto
 next
   assume 1: "\<forall>G.(M_generic(G)\<and> p\<in>G) \<longrightarrow> M[G] , map(val(G),env) \<Turnstile> \<phi>"
   {
     fix r
-    assume 2: "r\<in>P" "r\<preceq>p"
+    assume 2: "r\<in>\<bbbP>" "r\<preceq>p"
     then
     obtain G where "r\<in>G" "M_generic(G)"
       text\<open>Here we're using countability (via the existence of
         generic filters) of \<^term>\<open>M\<close> as a shortcut.\<close>
       using generic_filter_existence by auto
     moreover from this
-    interpret G_generic1 P leq \<one> M enum G 
+    interpret G_generic1 \<bbbP> leq \<one> M enum G 
       by (unfold_locales,simp)
-    from calculation 2 \<open>p\<in>P\<close>
+    from calculation 2 \<open>p\<in>\<bbbP>\<close>
     have "p\<in>G"
       using filter_leqD by auto
     moreover note 1
     ultimately
     have "M[G], map(val(G),env) \<Turnstile> \<phi>"
       by simp
     moreover
     note assms
     moreover from calculation
     obtain s where "s\<in>G" "(s \<tturnstile> \<phi> env)"
       using truth_lemma[of \<phi>] by blast
     moreover from this \<open>r\<in>G\<close>
-    obtain q where "q\<in>G" "q\<preceq>s" "q\<preceq>r" "s\<in>P" "q\<in>P"
+    obtain q where "q\<in>G" "q\<preceq>s" "q\<preceq>r" "s\<in>\<bbbP>" "q\<in>\<bbbP>"
       by blast
     ultimately
-    have "\<exists>q\<in>P. q\<preceq>r \<and> (q \<tturnstile> \<phi> env)"
+    have "\<exists>q\<in>\<bbbP>. q\<preceq>r \<and> (q \<tturnstile> \<phi> env)"
       using strengthening_lemma[of s] by auto
   }
   then
-  have "dense_below({q\<in>P. (q \<tturnstile> \<phi> env)},p)"
+  have "dense_below({q\<in>\<bbbP>. (q \<tturnstile> \<phi> env)},p)"
     unfolding dense_below_def by blast
   with assms
   show "(p \<tturnstile> \<phi> env)"
     using density_lemma by blast
 qed
 
 lemmas definability = forces_type
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Interface.thy b/thys/Independence_CH/Interface.thy
--- a/thys/Independence_CH/Interface.thy
+++ b/thys/Independence_CH/Interface.thy
@@ -1,1668 +1,1498 @@
 section\<open>Interface between set models and Constructibility\<close>
 
 text\<open>This theory provides an interface between Paulson's
 relativization results and set models of ZFC. In particular,
 it is used to prove that the locale \<^term>\<open>forcing_data\<close> is
 a sublocale of all relevant locales in \<^session>\<open>ZF-Constructible\<close>
 (\<^term>\<open>M_trivial\<close>, \<^term>\<open>M_basic\<close>, \<^term>\<open>M_eclose\<close>, etc).
 
 In order to interpret the locales in \<^session>\<open>ZF-Constructible\<close> we
 introduce new locales, each stronger than the previous one, assuming
 only the instances of Replacement needed to interpret the subsequent
 locales of that session. From the start we assume Separation for
 every internalized formula (with one parameter, but this is not a
 problem since we can use pairing).\<close>
 
 theory Interface
   imports
     Fm_Definitions
     Transitive_Models.Cardinal_AC_Relative
 begin
 
 locale M_Z_basic =
   fixes M
   assumes
     upair_ax:      "upair_ax(##M)" and
     Union_ax:      "Union_ax(##M)" and
     power_ax:      "power_ax(##M)" and
     extensionality:"extensionality(##M)" and
     foundation_ax: "foundation_ax(##M)" and
     infinity_ax:   "infinity_ax(##M)" and
     separation_ax: "\<phi> \<in> formula \<Longrightarrow> env \<in> list(M) \<Longrightarrow>
                     arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env) \<Longrightarrow>
                     separation(##M,\<lambda>x. (M, [x] @ env \<Turnstile> \<phi>))"
 
 locale M_transset =
   fixes M
   assumes
     trans_M:       "Transset(M)"
 
 locale M_Z_trans = M_Z_basic + M_transset
 
 locale M_ZF1 = M_Z_basic +
   assumes
     replacement_ax1:
-    "replacement_assm(M,env,list_repl1_intf_fm)"
-    "replacement_assm(M,env,list_repl2_intf_fm)"
-    "replacement_assm(M,env,formula_repl1_intf_fm)"
-    "replacement_assm(M,env,formula_repl2_intf_fm)"
     "replacement_assm(M,env,eclose_repl1_intf_fm)"
     "replacement_assm(M,env,eclose_repl2_intf_fm)"
     "replacement_assm(M,env,wfrec_rank_fm)"
     "replacement_assm(M,env,trans_repl_HVFrom_fm)"
-    "replacement_assm(M,env,tl_repl_intf_fm)"
 
 definition instances1_fms where "instances1_fms \<equiv>
-  { list_repl1_intf_fm,
-    list_repl2_intf_fm,
-    formula_repl1_intf_fm,
-    formula_repl2_intf_fm,
-    eclose_repl1_intf_fm,
+  { eclose_repl1_intf_fm,
     eclose_repl2_intf_fm,
     wfrec_rank_fm,
-    trans_repl_HVFrom_fm,
-    tl_repl_intf_fm
+    trans_repl_HVFrom_fm
  }"
 
-text\<open>This set has 9 internalized formulas.\<close>
+text\<open>This set has 4 internalized formulas.\<close>
 
 lemmas replacement_instances1_defs =
   list_repl1_intf_fm_def list_repl2_intf_fm_def
   formula_repl1_intf_fm_def formula_repl2_intf_fm_def
   eclose_repl1_intf_fm_def eclose_repl2_intf_fm_def
   wfrec_rank_fm_def trans_repl_HVFrom_fm_def tl_repl_intf_fm_def
 
 lemma instances1_fms_type[TC]: "instances1_fms \<subseteq> formula"
   using Lambda_in_M_fm_type
   unfolding replacement_instances1_defs instances1_fms_def by simp
 
 declare (in M_ZF1) replacement_instances1_defs[simp]
 
 locale M_ZF1_trans = M_ZF1 + M_Z_trans
 
 context M_Z_trans
 begin
 
 lemmas transitivity = Transset_intf[OF trans_M]
 
 subsection\<open>Interface with \<^term>\<open>M_trivial\<close>\<close>
 
 lemma zero_in_M:  "0 \<in> M"
 proof -
   obtain z where "empty(##M,z)"  "z\<in>M"
     using empty_intf[OF infinity_ax]
     by auto
   moreover from this
   have "z=0"
     using transitivity empty_def
     by auto
   ultimately
   show ?thesis
     by simp
 qed
 
 lemma separation_in_ctm :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" and
     satsQ: "\<And>x. x\<in>M \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "separation(##M,Q)"
   using assms separation_ax satsQ transitivity
     separation_cong[of "##M" "\<lambda>y. (M, [y]@env \<Turnstile> \<phi>)" "Q"]
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 locale M_ZC_basic = M_Z_basic + M_AC "##M"
 
 locale M_ZFC1 = M_ZF1 + M_ZC_basic
 
 locale M_ZFC1_trans = M_ZF1_trans + M_ZFC1
 
 sublocale M_Z_trans \<subseteq> M_trans "##M"
   using transitivity zero_in_M exI[of "\<lambda>x. x\<in>M"]
   by unfold_locales simp_all
 
 sublocale M_Z_trans \<subseteq> M_trivial "##M"
   using upair_ax Union_ax by unfold_locales
 
 subsection\<open>Interface with \<^term>\<open>M_basic\<close>\<close>
 
 definition Intersection where
   "Intersection(N,B,x) \<equiv> (\<forall>y[N]. y\<in>B \<longrightarrow> x\<in>y)"
 
 synthesize "Intersection" from_definition "Intersection" assuming "nonempty"
 arity_theorem for "Intersection_fm"
 
 definition CartProd where
   "CartProd(N,B,C,z) \<equiv> (\<exists>x[N]. x\<in>B \<and> (\<exists>y[N]. y\<in>C \<and> pair(N,x,y,z)))"
 
 synthesize "CartProd" from_definition "CartProd" assuming "nonempty"
 arity_theorem for "CartProd_fm"
 
 definition ImageSep where
   "ImageSep(N,B,r,y) \<equiv> (\<exists>p[N]. p\<in>r \<and> (\<exists>x[N]. x\<in>B \<and> pair(N,x,y,p)))"
 
 synthesize "ImageSep" from_definition  assuming "nonempty"
 arity_theorem for "ImageSep_fm"
 
 definition Converse where
   "Converse(N,R,z) \<equiv> \<exists>p[N]. p\<in>R \<and> (\<exists>x[N].\<exists>y[N]. pair(N,x,y,p) \<and> pair(N,y,x,z))"
 
 synthesize "Converse" from_definition "Converse" assuming "nonempty"
 arity_theorem for "Converse_fm"
 
 definition Restrict where
   "Restrict(N,A,z) \<equiv> \<exists>x[N]. x\<in>A \<and> (\<exists>y[N]. pair(N,x,y,z))"
 
 synthesize "Restrict" from_definition "Restrict" assuming "nonempty"
 arity_theorem for "Restrict_fm"
 
 definition Comp where
   "Comp(N,R,S,xz) \<equiv> \<exists>x[N]. \<exists>y[N]. \<exists>z[N]. \<exists>xy[N]. \<exists>yz[N].
               pair(N,x,z,xz) \<and> pair(N,x,y,xy) \<and> pair(N,y,z,yz) \<and> xy\<in>S \<and> yz\<in>R"
 
 synthesize "Comp" from_definition "Comp" assuming "nonempty"
 arity_theorem for "Comp_fm"
 
 definition Pred where
   "Pred(N,R,X,y) \<equiv> \<exists>p[N]. p\<in>R \<and> pair(N,y,X,p)"
 
 synthesize "Pred" from_definition "Pred" assuming "nonempty"
 arity_theorem for "Pred_fm"
 
 definition is_Memrel where
   "is_Memrel(N,z) \<equiv> \<exists>x[N]. \<exists>y[N]. pair(N,x,y,z) \<and> x \<in> y"
 
 synthesize "is_Memrel" from_definition "is_Memrel" assuming "nonempty"
 arity_theorem for "is_Memrel_fm"
 
 definition RecFun where
   "RecFun(N,r,f,g,a,b,x) \<equiv> \<exists>xa[N]. \<exists>xb[N].
                     pair(N,x,a,xa) \<and> xa \<in> r \<and> pair(N,x,b,xb) \<and> xb \<in> r \<and>
                     (\<exists>fx[N]. \<exists>gx[N]. fun_apply(N,f,x,fx) \<and> fun_apply(N,g,x,gx) \<and>
                                      fx \<noteq> gx)"
 
 synthesize "RecFun" from_definition "RecFun" assuming "nonempty"
 arity_theorem for "RecFun_fm"
 
 arity_theorem for "rtran_closure_mem_fm"
 
 synthesize "wellfounded_trancl" from_definition assuming "nonempty"
 arity_theorem for "wellfounded_trancl_fm"
 
 context M_Z_trans
 begin
 
 lemma inter_sep_intf :
   assumes "A\<in>M"
   shows "separation(##M,\<lambda>x . \<forall>y\<in>M . y\<in>A \<longrightarrow> x\<in>y)"
   using assms separation_in_ctm[of "Intersection_fm(1,0)" "[A]" "Intersection(##M,A)"]
     Intersection_iff_sats[of 1 "[_,A]" A 0 _ M] arity_Intersection_fm Intersection_fm_type
     ord_simp_union zero_in_M
   unfolding Intersection_def
   by simp
 
 lemma diff_sep_intf :
   assumes "B\<in>M"
   shows "separation(##M,\<lambda>x . x\<notin>B)"
   using assms separation_in_ctm[of "Neg(Member(0,1))" "[B]" "\<lambda>x . x\<notin>B"] ord_simp_union
   by simp
 
 lemma cartprod_sep_intf :
   assumes "A\<in>M" and "B\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>x\<in>M. x\<in>A \<and> (\<exists>y\<in>M. y\<in>B \<and> pair(##M,x,y,z)))"
   using assms separation_in_ctm[of "CartProd_fm(1,2,0)" "[A,B]" "CartProd(##M,A,B)"]
     CartProd_iff_sats[of 1 "[_,A,B]" A 2 B 0 _ M] arity_CartProd_fm  CartProd_fm_type
     ord_simp_union zero_in_M
   unfolding CartProd_def
   by simp
 
 lemma image_sep_intf :
   assumes "A\<in>M" and "B\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>p\<in>M. p\<in>B \<and> (\<exists>x\<in>M. x\<in>A \<and> pair(##M,x,y,p)))"
   using assms separation_in_ctm[of "ImageSep_fm(1,2,0)" "[A,B]" "ImageSep(##M,A,B)"]
     ImageSep_iff_sats[of 1 "[_,A,B]" _ 2 _ 0 _ M] arity_ImageSep_fm ImageSep_fm_type
     ord_simp_union zero_in_M
   unfolding ImageSep_def
   by simp
 
 lemma converse_sep_intf :
   assumes "R\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>p\<in>M. p\<in>R \<and> (\<exists>x\<in>M.\<exists>y\<in>M. pair(##M,x,y,p) \<and> pair(##M,y,x,z)))"
   using assms separation_in_ctm[of "Converse_fm(1,0)" "[R]" "Converse(##M,R)"]
     Converse_iff_sats[of 1 "[_,R]" _ 0 _ M] arity_Converse_fm Converse_fm_type
     ord_simp_union zero_in_M
   unfolding Converse_def
   by simp
 
 lemma restrict_sep_intf :
   assumes "A\<in>M"
   shows "separation(##M,\<lambda>z. \<exists>x\<in>M. x\<in>A \<and> (\<exists>y\<in>M. pair(##M,x,y,z)))"
   using assms separation_in_ctm[of "Restrict_fm(1,0)" "[A]" "Restrict(##M,A)"]
     Restrict_iff_sats[of 1 "[_,A]" _ 0 _ M] arity_Restrict_fm Restrict_fm_type
     ord_simp_union zero_in_M
   unfolding Restrict_def
   by simp
 
 lemma comp_sep_intf :
   assumes "R\<in>M" and "S\<in>M"
   shows "separation(##M,\<lambda>xz. \<exists>x\<in>M. \<exists>y\<in>M. \<exists>z\<in>M. \<exists>xy\<in>M. \<exists>yz\<in>M.
            pair(##M,x,z,xz) \<and> pair(##M,x,y,xy) \<and> pair(##M,y,z,yz) \<and> xy\<in>S \<and> yz\<in>R)"
   using assms separation_in_ctm[of "Comp_fm(1,2,0)" "[R,S]" "Comp(##M,R,S)"]
     Comp_iff_sats[of 1 "[_,R,S]" _ 2 _ 0 _ M] arity_Comp_fm Comp_fm_type
     ord_simp_union zero_in_M
   unfolding Comp_def
   by simp
 
 lemma pred_sep_intf:
   assumes "R\<in>M" and "X\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>p\<in>M. p\<in>R \<and> pair(##M,y,X,p))"
   using assms separation_in_ctm[of "Pred_fm(1,2,0)" "[R,X]" "Pred(##M,R,X)"]
     Pred_iff_sats[of 1 "[_,R,X]" _ 2 _ 0 _ M] arity_Pred_fm Pred_fm_type
     ord_simp_union zero_in_M
   unfolding Pred_def
   by simp
 
 lemma memrel_sep_intf:
   "separation(##M, \<lambda>z. \<exists>x\<in>M. \<exists>y\<in>M. pair(##M,x,y,z) \<and> x \<in> y)"
   using separation_in_ctm[of "is_Memrel_fm(0)" "[]" "is_Memrel(##M)"]
     is_Memrel_iff_sats[of 0 "[_]" _ M] arity_is_Memrel_fm is_Memrel_fm_type
     ord_simp_union zero_in_M
   unfolding is_Memrel_def
   by simp
 
 lemma is_recfun_sep_intf :
   assumes "r\<in>M" "f\<in>M" "g\<in>M" "a\<in>M" "b\<in>M"
   shows "separation(##M,\<lambda>x. \<exists>xa\<in>M. \<exists>xb\<in>M.
                     pair(##M,x,a,xa) \<and> xa \<in> r \<and> pair(##M,x,b,xb) \<and> xb \<in> r \<and>
                     (\<exists>fx\<in>M. \<exists>gx\<in>M. fun_apply(##M,f,x,fx) \<and> fun_apply(##M,g,x,gx) \<and>
                                      fx \<noteq> gx))"
   using assms separation_in_ctm[of "RecFun_fm(1,2,3,4,5,0)" "[r,f,g,a,b]" "RecFun(##M,r,f,g,a,b)"]
     RecFun_iff_sats[of 1 "[_,r,f,g,a,b]" _ 2 _ 3 _ 4 _ 5 _ 0 _ M] arity_RecFun_fm RecFun_fm_type
     ord_simp_union zero_in_M
   unfolding RecFun_def
   by simp
 
 lemmas M_basic_sep_instances =
   inter_sep_intf diff_sep_intf cartprod_sep_intf
   image_sep_intf converse_sep_intf restrict_sep_intf
   pred_sep_intf memrel_sep_intf comp_sep_intf is_recfun_sep_intf
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 sublocale M_Z_trans \<subseteq> M_basic_no_repl "##M"
   using power_ax M_basic_sep_instances
   by unfold_locales simp_all
 
 lemma Replace_eq_Collect:
   assumes "\<And>x y y'. x\<in>A \<Longrightarrow> P(x,y) \<Longrightarrow> P(x,y') \<Longrightarrow> y=y'" "{y . x \<in> A, P(x, y)} \<subseteq> B"
   shows "{y . x \<in> A, P(x, y)} = {y\<in>B . \<exists>x\<in>A. P(x,y)}"
   using assms by blast
 
 context M_Z_trans
 begin
 
 lemma Pow_inter_M_closed: assumes "A \<in> M" shows "Pow(A) \<inter> M \<in> M"
 proof -
   have "{a \<in> Pow(A) . a \<in> M} = Pow(A) \<inter> M" by auto
   then
   show ?thesis
     using power_ax powerset_abs assms unfolding power_ax_def
     by auto
 qed
 
 lemma Pow'_inter_M_closed: assumes "A \<in> M" shows "{a \<in> Pow(A) . a \<in> M} \<in> M"
   using power_ax powerset_abs assms unfolding power_ax_def by auto
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 context M_basic_no_repl
 begin
 
 lemma Replace_funspace_succ_rep_intf_sub:
   assumes
     "M(A)" "M(n)"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(M,p,z,n)}
       \<subseteq> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A)))))"
   unfolding funspace_succ_rep_intf_rel_def using assms mem_Pow_rel_abs
   by clarsimp (auto simp: cartprod_def)
 
 lemma funspace_succ_rep_intf_uniq:
   assumes
     "funspace_succ_rep_intf_rel(M,p,z,n)" "funspace_succ_rep_intf_rel(M,p,z',n)"
   shows
     "z = z'"
   using assms unfolding funspace_succ_rep_intf_rel_def by auto
 
 lemma Replace_funspace_succ_rep_intf_eq:
   assumes
     "M(A)" "M(n)"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(M,p,z,n)} =
      {z \<in> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A))))) .
         \<exists>p\<in>A. funspace_succ_rep_intf_rel(M,p,z,n)}"
   using assms Replace_eq_Collect[OF funspace_succ_rep_intf_uniq, of A,
       OF _ _ Replace_funspace_succ_rep_intf_sub[of A n], of "\<lambda>x y z. x" "\<lambda>x y z. n"]
   by (intro equalityI)
     (auto dest:transM simp:funspace_succ_rep_intf_rel_def)
 
 end \<comment> \<open>\<^locale>\<open>M_basic_no_repl\<close>\<close>
 
 definition fsri where
   "fsri(N,A,B) \<equiv> \<lambda>z. \<exists>p\<in>A. \<exists>f[N]. \<exists>b[N]. p = \<langle>f, b\<rangle> \<and> z = {cons(\<langle>B, b\<rangle>, f)}"
 
 relationalize "fsri" "is_fsri"
 synthesize "is_fsri" from_definition assuming "nonempty"
 arity_theorem for "is_fsri_fm"
 
 
 context M_Z_trans
 begin
 
 lemma separation_fsri:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> separation(##M, is_fsri(##M,A,B))"
   using separation_in_ctm[where env="[A,B]" and \<phi>="is_fsri_fm(1,2,0)"]
     zero_in_M is_fsri_iff_sats[symmetric] arity_is_fsri_fm is_fsri_fm_type
   by (simp_all add: ord_simp_union)
 
 lemma separation_funspace_succ_rep_intf_rel:
   "(##M)(A) \<Longrightarrow> (##M)(B) \<Longrightarrow> separation(##M, \<lambda>z. \<exists>p\<in>A. funspace_succ_rep_intf_rel(##M,p,z,B))"
   using separation_fsri zero_in_M
   by (rule_tac separation_cong[THEN iffD1, of _ "is_fsri(##M,A,B)"])
     (auto simp flip:setclass_iff dest:transM
       simp:is_fsri_def funspace_succ_rep_intf_rel_def, force)
 
 lemma Replace_funspace_succ_rep_intf_in_M:
   assumes
     "A \<in> M" "n \<in> M"
   shows
     "{z . p \<in> A, funspace_succ_rep_intf_rel(##M,p,z,n)} \<in> M"
 proof -
   have "(##M)({z \<in> Pow\<^bsup>M\<^esup>(Pow\<^bsup>M\<^esup>(\<Union>domain(A) \<union> ({n} \<times> range(A)) \<union> (\<Union>({n} \<times> range(A))))) .
         \<exists>p\<in>A. funspace_succ_rep_intf_rel(##M,p,z,n)})"
     using assms separation_funspace_succ_rep_intf_rel
     by (intro separation_closed) (auto simp flip:setclass_iff)
   with assms
   show ?thesis
     using Replace_funspace_succ_rep_intf_eq by auto
 qed
 
 lemma funspace_succ_rep_intf:
   assumes "n\<in>M"
   shows
     "strong_replacement(##M,
           \<lambda>p z. \<exists>f\<in>M. \<exists>b\<in>M. \<exists>nb\<in>M. \<exists>cnbf\<in>M.
                 pair(##M,f,b,p) \<and> pair(##M,n,b,nb) \<and> is_cons(##M,nb,f,cnbf) \<and>
                 upair(##M,cnbf,cnbf,z))"
   using assms pair_in_M_iff[simplified] cons_closed[simplified]
   unfolding strong_replacement_def univalent_def
   apply (clarsimp, rename_tac A)
   apply (rule_tac x="{z . p \<in> A, funspace_succ_rep_intf_rel(##M,p,z,n)}" in bexI)
    apply (auto simp:funspace_succ_rep_intf_rel_def
       Replace_funspace_succ_rep_intf_in_M[unfolded funspace_succ_rep_intf_rel_def, simplified])
   done
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 sublocale M_Z_trans \<subseteq> M_basic "##M"
   using power_ax M_basic_sep_instances funspace_succ_rep_intf
   by unfold_locales auto
 
 subsection\<open>Interface with \<^term>\<open>M_trancl\<close>\<close>
 
 context M_ZF1_trans
 begin
 
 lemma rtrancl_separation_intf:
   assumes "r\<in>M" "A\<in>M"
   shows "separation (##M, rtran_closure_mem(##M,A,r))"
   using assms separation_in_ctm[of "rtran_closure_mem_fm(1,2,0)" "[A,r]" "rtran_closure_mem(##M,A,r)"]
     arity_rtran_closure_mem_fm ord_simp_union zero_in_M
   by simp
 
 lemma wftrancl_separation_intf:
   assumes "r\<in>M" and "Z\<in>M"
   shows "separation (##M, wellfounded_trancl(##M,Z,r))"
   using assms separation_in_ctm[of "wellfounded_trancl_fm(1,2,0)" "[Z,r]" "wellfounded_trancl(##M,Z,r)"]
     arity_wellfounded_trancl_fm ord_simp_union zero_in_M
   by simp
 
 text\<open>To prove \<^term>\<open>nat \<in> M\<close> we get an infinite set \<^term>\<open>I\<close> from \<^term>\<open>infinity_ax\<close>
 closed under \<^term>\<open>0\<close> and \<^term>\<open>succ\<close>; that shows \<^term>\<open>nat\<subseteq>I\<close>. Then we
 can separate \<^term>\<open>I\<close> with the predicate \<^term>\<open>\<lambda>x. x\<in>nat\<close>.\<close>
 lemma finite_sep_intf: "separation(##M, \<lambda>x. x\<in>nat)"
 proof -
   have "(\<forall>v\<in>M. separation(##M,\<lambda>x. (M, [x,v] \<Turnstile> finite_ordinal_fm(0))))"
     using separation_ax arity_finite_ordinal_fm
     by simp
   then
   have "(\<forall>v\<in>M. separation(##M,finite_ordinal(##M)))"
     unfolding separation_def
     by simp
   then
   have "separation(##M,finite_ordinal(##M))"
     using separation_in_ctm zero_in_M
     by auto
   then
   show ?thesis
     unfolding separation_def
     by simp
 qed
 
 lemma nat_subset_I: "\<exists>I\<in>M. nat \<subseteq> I"
 proof -
   have "nat \<subseteq> I"
     if "I\<in>M" and "0\<in>I" and "\<And>x. x\<in>I \<Longrightarrow> succ(x)\<in>I" for I
     using that
     by (rule_tac subsetI,induct_tac x,simp_all)
   moreover
   obtain I where
     "I\<in>M" "0\<in>I" "\<And>x. x\<in>I \<Longrightarrow> succ(x)\<in>I"
     using infinity_ax transitivity
     unfolding infinity_ax_def
     by auto
   ultimately
   show ?thesis
     by auto
 qed
 
 lemma nat_in_M: "nat \<in> M"
 proof -
   have "{x\<in>B . x\<in>A}=A" if "A\<subseteq>B" for A B
     using that by auto
   moreover
   obtain I where
     "I\<in>M" "nat\<subseteq>I"
     using nat_subset_I by auto
   moreover from this
   have "{x\<in>I . x\<in>nat} \<in> M"
     using finite_sep_intf separation_closed[of "\<lambda>x . x\<in>nat"]
     by simp
   ultimately
   show ?thesis
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 sublocale M_ZF1_trans \<subseteq> M_trancl "##M"
   using rtrancl_separation_intf wftrancl_separation_intf nat_in_M
     wellfounded_trancl_def
   by unfold_locales auto
 
 subsection\<open>Interface with \<^term>\<open>M_eclose\<close>\<close>
 
 lemma repl_sats:
   assumes
     sat:"\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> (M, Cons(x,Cons(z,env)) \<Turnstile> \<phi>) \<longleftrightarrow> P(x,z)"
   shows
     "strong_replacement(##M,\<lambda>x z. (M, Cons(x,Cons(z,env)) \<Turnstile> \<phi>)) \<longleftrightarrow>
    strong_replacement(##M,P)"
   by (rule strong_replacement_cong,simp add:sat)
 
 arity_theorem for "list_functor_fm"
 arity_theorem for "formula_functor_fm"
 arity_theorem for "Inl_fm"
 arity_theorem for "Inr_fm"
 arity_theorem for "Nil_fm"
 arity_theorem for "Cons_fm"
 arity_theorem for "quasilist_fm"
 arity_theorem for "tl_fm"
 arity_theorem for "big_union_fm"
 
 context M_ZF1_trans
 begin
 
-lemma list_repl1_intf:
-  assumes "A\<in>M"
-  shows "iterates_replacement(##M, is_list_functor(##M,A), 0)"
-proof -
-  let ?f="Exists(And(pair_fm(1,0,2),
-               is_wfrec_fm(iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0),3,1,0)))"
-  have "arity(?f) = 5"
-    using arity_iterates_MH_fm[where isF="list_functor_fm(13,1,0)" and i=14]
-      arity_wfrec_replacement_fm[where i=11] arity_list_functor_fm ord_simp_union
-    by simp
-  {
-    fix n
-    assume "n\<in>nat"
-    then
-    have "Memrel(succ(n))\<in>M"
-      using nat_into_M Memrel_closed
-      by simp
-    moreover
-    note assms zero_in_M
-    moreover from calculation
-    have "is_list_functor(##M, A, a, b)
-       \<longleftrightarrow> (M, [b,a,c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),A,0] \<Turnstile> list_functor_fm(13,1,0))"
-      if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "a0\<in>M" "a1\<in>M" "a2\<in>M" "a3\<in>M" "a4\<in>M" "y\<in>M" "x\<in>M" "z\<in>M"
-      for a b c d a0 a1 a2 a3 a4 y x z
-      using that
-      by simp
-    moreover from calculation
-    have "(M, [a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),A,0] \<Turnstile>
-            iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0)) \<longleftrightarrow>
-          iterates_MH(##M,is_list_functor(##M,A),0,a2, a1, a0)"
-      if "a0\<in>M" "a1\<in>M" "a2\<in>M" "a3\<in>M" "a4\<in>M" "y\<in>M" "x\<in>M" "z\<in>M"
-      for a0 a1 a2 a3 a4 y x z
-      using that sats_iterates_MH_fm[of M "is_list_functor(##M,A)" _]
-      by simp
-    moreover from calculation
-    have "(M, [y,x,z,Memrel(succ(n)),A,0] \<Turnstile>
-              is_wfrec_fm(iterates_MH_fm(list_functor_fm(13,1,0),10,2,1,0),3,1,0)) \<longleftrightarrow>
-          is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) , Memrel(succ(n)), x, y)"
-      if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
-      using that sats_is_wfrec_fm
-      by simp
-    moreover from calculation
-    have "(M, [x,z,Memrel(succ(n)),A,0] \<Turnstile> ?f) \<longleftrightarrow>
-
-        (\<exists>y\<in>M. pair(##M,x,y,z) \<and>
-        is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) , Memrel(succ(n)), x, y))"
-      if "x\<in>M" "z\<in>M" for x z
-      using that
-      by (simp del:pair_abs)
-    moreover
-    note \<open>arity(?f) = 5\<close>
-    moreover from calculation
-    have "strong_replacement(##M,\<lambda>x z. (M, [x,z,Memrel(succ(n)),A,0] \<Turnstile> ?f))"
-      using replacement_ax1(1)[unfolded replacement_assm_def]
-      by simp
-    moreover from calculation
-    have "strong_replacement(##M,\<lambda>x z.
-          \<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, iterates_MH(##M,is_list_functor(##M,A),0) ,
-                Memrel(succ(n)), x, y))"
-      using repl_sats[of M ?f "[Memrel(succ(n)),A,0]"]
-      by (simp del:pair_abs)
-  }
-  then
-  show ?thesis
-    unfolding iterates_replacement_def wfrec_replacement_def
-    by simp
-qed
-
 text\<open>This lemma obtains \<^term>\<open>iterates_replacement\<close> for predicates
 without parameters.\<close>
 lemma iterates_repl_intf :
   assumes
     "v\<in>M" and
     isfm:"is_F_fm \<in> formula" and
     arty:"arity(is_F_fm)=2" and
     satsf: "\<And>a b env'. \<lbrakk> a\<in>M ; b\<in>M ; env'\<in>list(M) \<rbrakk>
               \<Longrightarrow> is_F(a,b) \<longleftrightarrow> (M,  [b,a]@env' \<Turnstile>  is_F_fm)"
     and is_F_fm_replacement:
     "\<And>env. (\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>) \<in> formula \<Longrightarrow> env \<in> list(M) \<Longrightarrow>
       arity((\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>)) \<le> 2 +\<^sub>\<omega> length(env) \<Longrightarrow>
      strong_replacement(##M,\<lambda>x y.
          M, [x,y] @ env \<Turnstile> (\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>))"
   shows
     "iterates_replacement(##M,is_F,v)"
 proof -
   let ?f="(\<cdot>\<exists>\<cdot>\<cdot>\<langle>1,0\<rangle> is 2\<cdot> \<and> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0) \<cdot>\<cdot>)"
   have "arity(?f) = 4" "?f\<in>formula"
     using arity_iterates_MH_fm[where isF=is_F_fm and i=2]
       arity_wfrec_replacement_fm[where i=10] isfm arty ord_simp_union
     by simp_all
   {
     fix n
     assume "n\<in>nat"
     then
     have "Memrel(succ(n))\<in>M"
       using nat_into_M Memrel_closed
       by simp
     moreover
     {
       fix a0 a1 a2 a3 a4 y x z
       assume "[a0,a1,a2,a3,a4,y,x,z]\<in>list(M)"
       moreover
       note \<open>v\<in>M\<close> \<open>Memrel(succ(n))\<in>M\<close>
       moreover from calculation
       have "(M, [b,a,c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v] \<Turnstile> is_F_fm) \<longleftrightarrow>
            is_F(a,b)"
         if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" for a b c d
         using that satsf[of a b "[c,d,a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v]"]
         by simp
       moreover from calculation
       have "(M, [a0,a1,a2,a3,a4,y,x,z,Memrel(succ(n)),v] \<Turnstile> iterates_MH_fm(is_F_fm,9,2,1,0)) \<longleftrightarrow>
            iterates_MH(##M,is_F,v,a2, a1, a0)"
         using sats_iterates_MH_fm[of M "is_F" "is_F_fm"]
         by simp
     }
     moreover from calculation
     have "(M, [y,x,z,Memrel(succ(n)),v] \<Turnstile> is_wfrec_fm(iterates_MH_fm(is_F_fm,9,2,1,0),3,1,0)) \<longleftrightarrow>
           is_wfrec(##M, iterates_MH(##M,is_F,v),Memrel(succ(n)), x, y)"
       if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
       using that sats_is_wfrec_fm \<open>v\<in>M\<close> by simp
     moreover from calculation
     have "(M, [x,z,Memrel(succ(n)),v] \<Turnstile> ?f) \<longleftrightarrow>
 
         (\<exists>y\<in>M. pair(##M,x,y,z) \<and>
         is_wfrec(##M, iterates_MH(##M,is_F,v) , Memrel(succ(n)), x, y))"
       if "x\<in>M" "z\<in>M" for x z
       using that \<open>v\<in>M\<close>
       by (simp del:pair_abs)
     moreover
     note \<open>arity(?f) = 4\<close> \<open>?f\<in>formula\<close>
     moreover from calculation \<open>v\<in>_\<close>
     have "strong_replacement(##M,\<lambda>x z. (M, [x,z,Memrel(succ(n)),v] \<Turnstile> ?f))"
       using is_F_fm_replacement
       by simp
     ultimately
     have "strong_replacement(##M,\<lambda>x z.
           \<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, iterates_MH(##M,is_F,v) ,
                 Memrel(succ(n)), x, y))"
       using repl_sats[of M ?f "[Memrel(succ(n)),v]"]
       by (simp del:pair_abs)
   }
   then
   show ?thesis
     unfolding iterates_replacement_def wfrec_replacement_def
     by simp
 qed
 
-lemma formula_repl1_intf : "iterates_replacement(##M, is_formula_functor(##M), 0)"
-  using arity_formula_functor_fm zero_in_M ord_simp_union
-    iterates_repl_intf[where is_F_fm="formula_functor_fm(1,0)"]
-    replacement_ax1(3)[unfolded replacement_assm_def]
-  by simp
-
-lemma tl_repl_intf:
-  assumes "l \<in> M"
-  shows "iterates_replacement(##M,\<lambda>l' t. is_tl(##M,l',t),l)"
-  using assms arity_tl_fm ord_simp_union
-    iterates_repl_intf[where is_F_fm="tl_fm(1,0)"]
-    replacement_ax1(9)[unfolded replacement_assm_def]
-  by simp
-
 lemma eclose_repl1_intf:
   assumes "A\<in>M"
   shows "iterates_replacement(##M, big_union(##M), A)"
   using assms arity_big_union_fm
     iterates_repl_intf[where is_F_fm="big_union_fm(1,0)"]
-    replacement_ax1(5)[unfolded replacement_assm_def]
+    replacement_ax1(1)[unfolded replacement_assm_def]
     ord_simp_union
   by simp
 
-lemma list_repl2_intf:
-  assumes "A\<in>M"
-  shows "strong_replacement(##M,\<lambda>n y. n\<in>nat \<and>
-            is_iterates(##M, is_list_functor(##M,A), 0, n, y))"
-proof -
-  let ?f = "And(Member(0,4),is_iterates_fm(list_functor_fm(13,1,0),3,0,1))"
-  note zero_in_M nat_in_M \<open>A\<in>M\<close>
-  moreover from this
-  have "is_list_functor(##M,A,a,b) \<longleftrightarrow>
-        (M, [b,a,c,d,e,f,g,h,i,j,k,n,y,A,0,nat] \<Turnstile> list_functor_fm(13,1,0))"
-    if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "f\<in>M""g\<in>M""h\<in>M""i\<in>M""j\<in>M" "k\<in>M" "n\<in>M" "y\<in>M"
-    for a b c d e f g h i j k n y
-    using that
-    by simp
-  moreover from calculation
-  have "(M, [n,y,A,0,nat] \<Turnstile> is_iterates_fm(list_functor_fm(13,1,0),3,0,1)) \<longleftrightarrow>
-           is_iterates(##M, is_list_functor(##M,A), 0, n , y)"
-    if "n\<in>M" "y\<in>M" for n y
-    using that sats_is_iterates_fm[of M "is_list_functor(##M,A)"]
-    by simp
-  moreover from calculation
-  have "(M, [n,y,A,0,nat] \<Turnstile> ?f) \<longleftrightarrow>
-        n\<in>nat \<and> is_iterates(##M, is_list_functor(##M,A), 0, n, y)"
-    if "n\<in>M" "y\<in>M" for n y
-    using that
-    by simp
-  moreover
-  have "arity(?f) = 5"
-    using arity_is_iterates_fm[where p="list_functor_fm(13,1,0)" and i=14]
-      arity_list_functor_fm arity_And ord_simp_union
-    by simp
-  ultimately
-  show ?thesis
-    using replacement_ax1(2)[unfolded replacement_assm_def] repl_sats[of M ?f "[A,0,nat]"]
-    by simp
-qed
-
-lemma formula_repl2_intf:
-  "strong_replacement(##M,\<lambda>n y. n\<in>nat \<and> is_iterates(##M, is_formula_functor(##M), 0, n, y))"
-proof -
-  let ?f = "And(Member(0,3),is_iterates_fm(formula_functor_fm(1,0),2,0,1))"
-  note zero_in_M nat_in_M
-  moreover from this
-  have "is_formula_functor(##M,a,b) \<longleftrightarrow>
-        (M, [b,a,c,d,e,f,g,h,i,j,k,n,y,0,nat] \<Turnstile> formula_functor_fm(1,0))"
-    if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "f\<in>M""g\<in>M""h\<in>M""i\<in>M""j\<in>M" "k\<in>M" "n\<in>M" "y\<in>M"
-    for a b c d e f g h i j k n y
-    using that
-    by simp
-  moreover from calculation
-  have "(M, [n,y,0,nat] \<Turnstile> is_iterates_fm(formula_functor_fm(1,0),2,0,1)) \<longleftrightarrow>
-           is_iterates(##M, is_formula_functor(##M), 0, n , y)"
-    if "n\<in>M" "y\<in>M" for n y
-    using that sats_is_iterates_fm[of M "is_formula_functor(##M)"]
-    by simp
-  moreover from calculation
-  have "(M, [n,y,0,nat] \<Turnstile> ?f) \<longleftrightarrow>
-        n\<in>nat \<and> is_iterates(##M, is_formula_functor(##M), 0, n, y)"
-    if "n\<in>M" "y\<in>M" for n y
-    using that
-    by simp
-  moreover
-  have "arity(?f) = 4"
-    using arity_is_iterates_fm[where p="formula_functor_fm(1,0)" and i=2]
-      arity_formula_functor_fm arity_And ord_simp_union
-    by simp
-  ultimately
-  show ?thesis
-    using replacement_ax1(4)[unfolded replacement_assm_def] repl_sats[of M ?f "[0,nat]"]
-    by simp
-qed
-
-
 lemma eclose_repl2_intf:
   assumes "A\<in>M"
   shows "strong_replacement(##M,\<lambda>n y. n\<in>nat \<and> is_iterates(##M, big_union(##M), A, n, y))"
 proof -
   let ?f = "And(Member(0,3),is_iterates_fm(big_union_fm(1,0),2,0,1))"
   note nat_in_M \<open>A\<in>M\<close>
   moreover from this
   have "big_union(##M,a,b) \<longleftrightarrow>
         (M, [b,a,c,d,e,f,g,h,i,j,k,n,y,A,nat] \<Turnstile> big_union_fm(1,0))"
     if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "f\<in>M""g\<in>M""h\<in>M""i\<in>M""j\<in>M" "k\<in>M" "n\<in>M" "y\<in>M"
     for a b c d e f g h i j k n y
     using that by simp
   moreover from calculation
   have "(M, [n,y,A,nat] \<Turnstile> is_iterates_fm(big_union_fm(1,0),2,0,1)) \<longleftrightarrow>
            is_iterates(##M, big_union(##M), A, n , y)"
     if "n\<in>M" "y\<in>M" for n y
     using that sats_is_iterates_fm[of M "big_union(##M)"]
     by simp
   moreover from calculation
   have "(M, [n,y,A,nat] \<Turnstile> ?f) \<longleftrightarrow>
         n\<in>nat \<and> is_iterates(##M, big_union(##M), A, n, y)"
     if "n\<in>M" "y\<in>M" for n y
     using that
     by simp
   moreover
   have "arity(?f) = 4"
     using arity_is_iterates_fm[where p="big_union_fm(1,0)" and i=2]
       arity_big_union_fm arity_And ord_simp_union
     by simp
   ultimately
   show ?thesis
-    using repl_sats[of M ?f "[A,nat]"] replacement_ax1(6)[unfolded replacement_assm_def]
+    using repl_sats[of M ?f "[A,nat]"] replacement_ax1(2)[unfolded replacement_assm_def]
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
-sublocale M_ZF1_trans \<subseteq> M_datatypes "##M"
-  using list_repl1_intf list_repl2_intf formula_repl1_intf
-    formula_repl2_intf tl_repl_intf
-  by unfold_locales auto
-
 sublocale M_ZF1_trans \<subseteq> M_eclose "##M"
   using eclose_repl1_intf eclose_repl2_intf
   by unfold_locales auto
 
 text\<open>Interface with \<^locale>\<open>M_eclose\<close>.\<close>
 
 schematic_goal sats_is_Vset_fm_auto:
   assumes
     "i\<in>nat" "v\<in>nat" "env\<in>list(A)" "0\<in>A"
     "i < length(env)" "v < length(env)"
   shows
     "is_Vset(##A,nth(i, env),nth(v, env)) \<longleftrightarrow> (A, env \<Turnstile> ?ivs_fm(i,v))"
   unfolding is_Vset_def is_Vfrom_def
   by (insert assms; (rule sep_rules is_HVfrom_iff_sats is_transrec_iff_sats | simp)+)
 
 synthesize "is_Vset" from_schematic "sats_is_Vset_fm_auto"
 arity_theorem for "is_Vset_fm"
 
 declare is_Hrank_fm_def[fm_definitions add]
 
 context M_ZF1_trans
 begin
 
 lemma wfrec_rank :
   assumes "X\<in>M"
   shows "wfrec_replacement(##M,is_Hrank(##M),rrank(X))"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0)))"
   note assms zero_in_M
   moreover from this
   have
     "is_Hrank(##M,a2, a1, a0) \<longleftrightarrow>
              (M, [a0,a1,a2,a3,a4,y,x,z,rrank(X)] \<Turnstile> is_Hrank_fm(2,1,0))"
     if "a4\<in>M" "a3\<in>M" "a2\<in>M" "a1\<in>M" "a0\<in>M" "y\<in>M" "x\<in>M" "z\<in>M" for a4 a3 a2 a1 a0 y x z
     using that rrank_in_M is_Hrank_iff_sats
     by simp
   moreover from calculation
   have "(M, [y,x,z,rrank(X)] \<Turnstile> is_wfrec_fm(is_Hrank_fm(2,1,0),3,1,0)) \<longleftrightarrow>
    is_wfrec(##M, is_Hrank(##M) ,rrank(X), x, y)"
     if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
     using that rrank_in_M sats_is_wfrec_fm
     by simp
   moreover from calculation
   have "(M, [x,z,rrank(X)] \<Turnstile> ?f) \<longleftrightarrow>
                (\<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, is_Hrank(##M) , rrank(X), x, y))"
     if "x\<in>M" "z\<in>M" for x z
     using that rrank_in_M
     by (simp del:pair_abs)
   moreover
   have "arity(?f) = 3"
     using arity_wfrec_replacement_fm[where p="is_Hrank_fm(2,1,0)" and i=3,simplified]
       arity_is_Hrank_fm[of 2 1 0,simplified] ord_simp_union
     by simp
   moreover from calculation
   have "strong_replacement(##M,\<lambda>x z. (M, [x,z,rrank(X)] \<Turnstile> ?f))"
-    using replacement_ax1(7)[unfolded replacement_assm_def] rrank_in_M
+    using replacement_ax1(3)[unfolded replacement_assm_def] rrank_in_M
     by simp
   ultimately
   show ?thesis
     using repl_sats[of M ?f "[rrank(X)]"]
     unfolding wfrec_replacement_def
     by (simp del:pair_abs)
 qed
 
 lemma trans_repl_HVFrom :
   assumes "A\<in>M" "i\<in>M"
   shows "transrec_replacement(##M,is_HVfrom(##M,A),i)"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0)))"
   note facts = assms zero_in_M
   moreover
   have "\<exists>sa\<in>M. \<exists>esa\<in>M. \<exists>mesa\<in>M.
        upair(##M,a,a,sa) \<and> is_eclose(##M,sa,esa) \<and> membership(##M,esa,mesa)"
     if "a\<in>M" for a
     using that upair_ax eclose_closed Memrel_closed
     unfolding upair_ax_def
     by (simp del:upair_abs)
   moreover
   {
     fix mesa
     assume "mesa\<in>M"
     moreover
     note facts
     moreover from calculation
     have "is_HVfrom(##M,A,a2, a1, a0) \<longleftrightarrow>
       (M, [a0,a1,a2,a3,a4,y,x,z,A,mesa] \<Turnstile> is_HVfrom_fm(8,2,1,0))"
       if "a4\<in>M" "a3\<in>M" "a2\<in>M" "a1\<in>M" "a0\<in>M" "y\<in>M" "x\<in>M" "z\<in>M" for a4 a3 a2 a1 a0 y x z
       using that sats_is_HVfrom_fm
       by simp
     moreover from calculation
     have "(M, [y,x,z,A,mesa] \<Turnstile> is_wfrec_fm(is_HVfrom_fm(8,2,1,0),4,1,0)) \<longleftrightarrow>
          is_wfrec(##M, is_HVfrom(##M,A),mesa, x, y)"
       if "y\<in>M" "x\<in>M" "z\<in>M" for y x z
       using that sats_is_wfrec_fm
       by simp
     moreover from calculation
     have "(M, [x,z,A,mesa] \<Turnstile> ?f) \<longleftrightarrow>
                (\<exists>y\<in>M. pair(##M,x,y,z) \<and> is_wfrec(##M, is_HVfrom(##M,A) , mesa, x, y))"
       if "x\<in>M" "z\<in>M" for x z
       using that
       by (simp del:pair_abs)
     moreover
     have "arity(?f) = 4"
       using arity_wfrec_replacement_fm[where p="is_HVfrom_fm(8,2,1,0)" and i=9]
         arity_is_HVfrom_fm ord_simp_union
       by simp
     moreover from calculation
     have "strong_replacement(##M,\<lambda>x z. (M, [x,z,A,mesa] \<Turnstile> ?f))"
-      using replacement_ax1(8)[unfolded replacement_assm_def]
+      using replacement_ax1(4)[unfolded replacement_assm_def]
       by simp
     ultimately
     have "wfrec_replacement(##M,is_HVfrom(##M,A),mesa)"
       using repl_sats[of M ?f "[A,mesa]"]
       unfolding wfrec_replacement_def
       by (simp del:pair_abs)
   }
   ultimately
   show ?thesis
     unfolding transrec_replacement_def
     by simp
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 subsection\<open>Interface for proving Collects and Replace in M.\<close>
 context M_ZF1_trans
 begin
 
 lemma Collect_in_M :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" "A\<in>M" and
     satsQ: "\<And>x. x\<in>M \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "{y\<in>A . Q(y)}\<in>M"
 proof -
   have "separation(##M,\<lambda>x. (M, [x] @ env \<Turnstile> \<phi>))"
     using assms separation_ax by simp
   then
   show ?thesis
     using \<open>A\<in>M\<close> satsQ transitivity separation_closed
       separation_cong[of "##M" "\<lambda>y. (M, [y]@env \<Turnstile> \<phi>)" "Q"]
     by simp
 qed
 
 \<comment> \<open>This version has a weaker assumption.\<close>
 lemma separation_in_M :
   assumes
     "\<phi> \<in> formula" "env\<in>list(M)"
     "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" "A\<in>M" and
     satsQ: "\<And>x. x\<in>A \<Longrightarrow> (M, [x]@env \<Turnstile> \<phi>) \<longleftrightarrow> Q(x)"
   shows
     "{y\<in>A . Q(y)} \<in> M"
 proof -
   let ?\<phi>' = "And(\<phi>,Member(0,length(env)+\<^sub>\<omega>1))"
   note assms
   moreover
   have "arity(?\<phi>') \<le> 1 +\<^sub>\<omega> length(env@[A])"
     using assms Un_le le_trans[of "arity(\<phi>)" "1+\<^sub>\<omega>length(env)" "2+\<^sub>\<omega>length(env)"]
     by (force simp:FOL_arities)
   moreover from calculation
   have "?\<phi>'\<in>formula" "nth(length(env), env @ [A]) = A"
     using nth_append
     by auto
   moreover from calculation
   have "\<And> x . x \<in> M \<Longrightarrow> (M, [x]@env@[A] \<Turnstile> ?\<phi>') \<longleftrightarrow> Q(x) \<and> x\<in>A"
     using arity_sats_iff[of _ "[A]" _ "[_]@env"]
     by auto
   ultimately
   show ?thesis
     using Collect_in_M[of ?\<phi>' "env@[A]" _ "\<lambda>x . Q(x) \<and> x\<in>A", OF _ _ _ \<open>A\<in>M\<close>]
     by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ZF1_trans\<close>\<close>
 
 context M_Z_trans
 begin
 
 lemma strong_replacement_in_ctm:
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>M \<Longrightarrow> f(x) \<in> M" and
     phi_replacement:"replacement_assm(M,env,\<phi>)" and
     "env\<in>list(M)"
   shows "strong_replacement(##M, \<lambda>x y . y = f(x))"
   using assms
     strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env\<Turnstile>\<phi>" "\<lambda>x y. y = f(x)"]
   unfolding replacement_assm_def
   by auto
 
 lemma strong_replacement_rel_in_ctm :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> f(x,y)"  and
     phi_replacement:"replacement_assm(M,env,\<phi>)" and
     "env\<in>list(M)"
   shows "strong_replacement(##M, f)"
   using assms
     strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env\<Turnstile>\<phi>" "f"]
   unfolding replacement_assm_def
   by auto
 
 lemma Replace_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M"  and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement:"replacement_assm(M,env@[A], \<cdot>\<phi> \<and> \<cdot>0 \<in> length(env) +\<^sub>\<omega> 2\<cdot>\<cdot> )"
   shows "{f(x) . x\<in>A}\<in>M"
 proof -
   let ?\<phi>' = "And(\<phi>,Member(0,length(env)+\<^sub>\<omega>2))"
   note assms
   moreover from this
   have "arity(?\<phi>') \<le> 2 +\<^sub>\<omega> length(env@[A])"
     using Un_le le_trans[of "arity(\<phi>)" "2+\<^sub>\<omega>(length(env))" "3+\<^sub>\<omega>length(env)"]
     by (force simp:FOL_arities)
   moreover from calculation
   have "?\<phi>'\<in>formula" "nth(length(env), env @ [A]) = A"
     using nth_append by auto
   moreover from calculation
   have "\<And> x y. x \<in> M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env@[A]\<Turnstile>?\<phi>') \<longleftrightarrow> y=f(x) \<and>x\<in>A"
     using arity_sats_iff[of _ "[A]" _ "[_,_]@env"]
     by auto
   moreover from calculation
   have "strong_replacement(##M, \<lambda>x y. M,[x,y]@env@[A] \<Turnstile> ?\<phi>')"
     using phi'_replacement assms(1-6) unfolding replacement_assm_def by simp
   ultimately
   have 4:"strong_replacement(##M, \<lambda>x y. y = f(x) \<and> x\<in>A)"
     using
       strong_replacement_cong[of "##M" "\<lambda>x y. M,[x,y]@env@[A]\<Turnstile>?\<phi>'" "\<lambda>x y. y = f(x) \<and> x\<in>A"]
     by simp
   then
   have "{y . x\<in>A , y = f(x)} \<in> M"
     using \<open>A\<in>M\<close> strong_replacement_closed[OF 4,of A] fclosed by simp
   moreover
   have "{f(x). x\<in>A} = { y . x\<in>A , y = f(x)}"
     by auto
   ultimately
   show ?thesis by simp
 qed
 
 lemma Replace_relativized_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M"  and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement:"replacement_assm(M,env@[A], \<cdot>\<phi> \<and> \<cdot>0 \<in> length(env) +\<^sub>\<omega> 2\<cdot>\<cdot> )"
   shows "{f(x) . x\<in>A}\<in>M"
   using assms Replace_in_M[of \<phi>] by auto
 
 lemma ren_action :
   assumes
     "env\<in>list(M)" "x\<in>M" "y\<in>M" "z\<in>M"
   shows "\<forall> i . i < 2+\<^sub>\<omega>length(env) \<longrightarrow>
           nth(i,[x,z]@env) = nth(\<rho>_repl(length(env))`i,[z,x,y]@env)"
 proof -
   let ?f="{\<langle>0, 1\<rangle>, \<langle>1, 0\<rangle>}"
   have 1:"(\<And>j. j < length(env) \<Longrightarrow> nth(j, env) = nth(id(length(env)) ` j, env))"
     using assms ltD by simp
   have 2:"nth(j, [x,z]) = nth(?f ` j, [z,x,y])" if "j<2" for j
   proof -
     consider "j=0" | "j=1" using  ltD[OF \<open>j<2\<close>] by auto
     then show ?thesis
     proof(cases)
       case 1
       then show ?thesis using apply_equality f_type by simp
     next
       case 2
       then show ?thesis using apply_equality f_type by simp
     qed
   qed
   show ?thesis
     using sum_action[OF _ _ _ _ f_type id_type _ _ _ _ _ _ _ 2 1,simplified] assms
     unfolding \<rho>_repl_def by simp
 qed
 
 lemma Lambda_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>A \<Longrightarrow> f(x) \<in> M" and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement2: "replacement_assm(M,env@[A],Lambda_in_M_fm(\<phi>,length(env)))"
   shows "(\<lambda>x\<in>A . f(x)) \<in>M"
   unfolding lam_def
 proof -
   let ?ren="\<rho>_repl(length(env))"
   let ?j="2+\<^sub>\<omega>length(env)"
   let ?k="3+\<^sub>\<omega>length(env)"
   let ?\<psi>="ren(\<phi>)`?j`?k`?ren"
   let ?\<phi>'="Exists(And(pair_fm(1,0,2),?\<psi>))"
   let ?p="\<lambda>x y. \<exists>z\<in>M. pair(##M,x,z,y) \<and> is_f(x,z)"
   have "?\<phi>'\<in>formula" "?\<psi>\<in>formula"
     using \<open>env\<in>_\<close> length_type f_fm ren_type ren_tc[of \<phi> "2+\<^sub>\<omega>length(env)" "3+\<^sub>\<omega>length(env)" ?ren]
     by simp_all
   moreover from this
   have "arity(?\<psi>)\<le>3+\<^sub>\<omega>(length(env))" "arity(?\<psi>)\<in>nat"
     using assms arity_ren[OF f_fm _ _ ren_type,of "length(env)"] by simp_all
   then
   have "arity(?\<phi>') \<le> 2+\<^sub>\<omega>(length(env))"
     using Un_le pred_Un_distrib assms pred_le
     by (simp add:arity)
   moreover from this calculation
   have "x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(x,y)" for x y
     using \<open>env\<in>_\<close> length_type[OF \<open>env\<in>_\<close>] assms transitivity[OF _ \<open>A\<in>M\<close>]
       sats_iff_sats_ren[OF f_fm _ _ _ _ ren_type f_ar ren_action[rule_format,of _ x y],of _ M ]
     by auto
   moreover
   have "x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> ?p(x,y) \<longleftrightarrow> y = <x,f(x)>" for x y
     using assms transitivity[OF _ \<open>A\<in>_\<close>] fclosed
     by simp
   moreover
   have "\<And> x . x\<in>A \<Longrightarrow> <x,f(x)> \<in> M"
     using transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fclosed by simp
   ultimately
   show "{\<langle>x,f(x)\<rangle> . x\<in>A } \<in> M"
     using Replace_in_M[of ?\<phi>' env A] phi'_replacement2 \<open>A\<in>M\<close> \<open>env\<in>_\<close>
     by simp
 qed
 
 lemma ren_action' :
   assumes
     "env\<in>list(M)" "x\<in>M" "y\<in>M" "z\<in>M" "u\<in>M"
   shows "\<forall> i . i < 3+\<^sub>\<omega>length(env) \<longrightarrow>
           nth(i,[x,z,u]@env) = nth(\<rho>_pair_repl(length(env))`i,[x,z,y,u]@env)"
 proof -
   let ?f="{\<langle>0, 0\<rangle>, \<langle>1, 1\<rangle>, \<langle>2,3\<rangle>}"
   have 1:"(\<And>j. j < length(env) \<Longrightarrow> nth(j, env) = nth(id(length(env)) ` j, env))"
     using assms ltD by simp
   have 2:"nth(j, [x,z,u]) = nth(?f ` j, [x,z,y,u])" if "j<3" for j
   proof -
     consider "j=0" | "j=1" | "j=2" using  ltD[OF \<open>j<3\<close>] by auto
     then show ?thesis
     proof(cases)
       case 1
       then show ?thesis using apply_equality f_type' by simp
     next
       case 2
       then show ?thesis using apply_equality f_type' by simp
     next
       case 3
       then show ?thesis using apply_equality f_type' by simp
     qed
   qed
   show ?thesis
     using sum_action[OF _ _ _ _ f_type' id_type _ _ _ _ _ _ _ 2 1,simplified] assms
     unfolding \<rho>_pair_repl_def by simp
 qed
 
 lemma LambdaPair_in_M :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 3 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> (M,[x,z,r]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,r)" and
     fabs:  "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> is_f(x,z,r) \<longleftrightarrow> r = f(x,z)" and
     fclosed: "\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "A\<in>M" "env\<in>list(M)" and
     phi'_replacement3: "replacement_assm(M,env@[A],LambdaPair_in_M_fm(\<phi>,length(env)))"
   shows "(\<lambda>x\<in>A . f(fst(x),snd(x))) \<in>M"
 proof -
   let ?ren="\<rho>_pair_repl(length(env))"
   let ?j="3+\<^sub>\<omega>length(env)"
   let ?k="4+\<^sub>\<omega>length(env)"
   let ?\<psi>="ren(\<phi>)`?j`?k`?ren"
   let ?\<phi>'="Exists(Exists(And(fst_fm(2,0),(And(snd_fm(2,1),?\<psi>)))))"
   let ?p="\<lambda>x y. is_f(fst(x),snd(x),y)"
   have "?\<phi>'\<in>formula" "?\<psi>\<in>formula"
     using \<open>env\<in>_\<close> length_type f_fm ren_type' ren_tc[of \<phi> ?j ?k ?ren]
     by simp_all
   moreover from this
   have "arity(?\<psi>)\<le>4+\<^sub>\<omega>(length(env))" "arity(?\<psi>)\<in>nat"
     using assms arity_ren[OF f_fm _ _ ren_type',of "length(env)"] by simp_all
   moreover from calculation
   have 1:"arity(?\<phi>') \<le> 2+\<^sub>\<omega>(length(env))" "?\<phi>'\<in>formula"
     using Un_le pred_Un_distrib assms pred_le
     by (simp_all add:arity)
   moreover from this calculation
   have 2:"x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(x,y)" for x y
     using
       sats_iff_sats_ren[OF f_fm _ _ _ _ ren_type' f_ar
         ren_action'[rule_format,of _ "fst(x)" x "snd(x)" y],simplified]
       \<open>env\<in>_\<close> length_type[OF \<open>env\<in>_\<close>] transitivity[OF _ \<open>A\<in>M\<close>]
       fst_snd_closed pair_in_M_iff fsats[of "fst(x)" "snd(x)" y,symmetric]
       fst_abs snd_abs
     by auto
   moreover from assms
   have 3:"x\<in>A \<Longrightarrow> y\<in>M \<Longrightarrow> ?p(x,y) \<longleftrightarrow> y = f(fst(x),snd(x))" for x y
     using fclosed fst_snd_closed pair_in_M_iff fabs transitivity
     by auto
   moreover
   have 4:"\<And> x . x\<in>A \<Longrightarrow> <x,f(fst(x),snd(x))> \<in> M" "\<And> x . x\<in>A \<Longrightarrow> f(fst(x),snd(x)) \<in> M"
     using transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fclosed fst_snd_closed
     by simp_all
   ultimately
   show ?thesis
     using Lambda_in_M[unfolded Lambda_in_M_fm_def, of ?\<phi>', OF _ _ _ _ _ _ _
         phi'_replacement3[unfolded LambdaPair_in_M_fm_def]]
       \<open>env\<in>_\<close> \<open>A\<in>_\<close> by simp
 
 qed
 
 lemma (in M_ZF1_trans) lam_replacement2_in_ctm :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>)\<le> 3 +\<^sub>\<omega> length(env)" and
     fsats: "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> (M,[x,z,r]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,r)" and
     fabs:  "\<And>x z r. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> is_f(x,z,r) \<longleftrightarrow> r = f(x,z)" and
     fclosed: "\<And>x z. x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "env\<in>list(M)" and
     phi'_replacement3: "\<And>A. A\<in>M \<Longrightarrow> replacement_assm(M,env@[A],LambdaPair_in_M_fm(\<phi>,length(env)))"
   shows "lam_replacement(##M , \<lambda>x . f(fst(x),snd(x)))"
   using
     LambdaPair_in_M fabs
     f_ar ord_simp_union transitivity assms fst_snd_closed
   by (rule_tac lam_replacement_iff_lam_closed[THEN iffD2],simp_all)
 
 simple_rename "ren_U" src "[z1,x_P, x_leq, x_o, x_t, z2_c]"
   tgt "[z2_c,z1,z,x_P, x_leq, x_o, x_t]"
 
 simple_rename "ren_V" src "[fz,x_P, x_leq, x_o,x_f, x_t, gz]"
   tgt "[gz,fz,z,x_P, x_leq, x_o,x_f, x_t]"
 
 simple_rename "ren_V3" src "[fz,x_P, x_leq, x_o,x_f, gz, hz]"
   tgt "[hz,gz,fz,z,x_P, x_leq, x_o,x_f]"
 
 lemma separation_sat_after_function_1:
   assumes "[a,b,c,d]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 6"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 6" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 7" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow>  fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, g(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-4)
   let ?\<psi>="ren(\<chi>)`6`7`ren_U_fn"
   let  ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,?\<psi>))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d, g(z)]"
   let ?env="[a, b, c, d]"
   let ?\<eta>="\<lambda>z.[g(z),f(z),z]@?env"
   note types
   moreover from this
   have "arity(\<chi>) \<le> 7" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_U_thm(2)[folded ren_U_fn_def] le_trans[of "arity(\<chi>)" 6]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 7" "?\<psi>'\<in>formula"
     using arity_ren ren_U_thm(2)[folded ren_U_fn_def] f_fm g_fm
     by simp_all
   moreover from calculation f_ar g_ar f_fm g_fm
   have "arity(?\<psi>') \<le> 5"
     using ord_simp_union pred_le arity_type
     by (simp add:arity)
   moreover from calculation fclosed gclosed
   have 0:"(M, [f(z), a, b, c, d,  g(z)] \<Turnstile> \<chi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of \<chi> 6 7 _ _ "?\<eta>(z)"]
       ren_U_thm(1)[where A=M,folded ren_U_fn_def] ren_U_thm(2)[folded ren_U_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z]  gsats[of "g(z)" "f(z)" z] fclosed gclosed f_fm g_fm
   proof(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp,(auto)[1])
     assume "M, [z] @ [a, b, c, d] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> ren(\<chi>) ` 6 ` 7 ` ren_U_fn\<cdot>\<cdot>)\<cdot>\<cdot>)"
     then
     have "\<exists>xa\<in>M. (M, [xa, z, a, b, c, d] \<Turnstile> f_fm) \<and>
           (\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d] \<Turnstile> g_fm) \<and>
             (M, [x, xa, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn))"
       using that calculation by auto
     then
     obtain xa x where "x\<in>M" "xa\<in>M" "M, [xa, z, a, b, c, d] \<Turnstile> f_fm"
       "(M, [x, xa, z, a, b, c, d] \<Turnstile> g_fm)"
       "(M, [x, xa, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn)"
       using that calculation by auto
     moreover from this
     have "xa=f(z)" "x=g(z)" using fsats[of xa]  gsats[of x xa] that by simp_all
     ultimately
     show "M, [g(z), f(z), z] @ [a, b, c, d] \<Turnstile> ren(\<chi>) ` 6 ` 7 ` ren_U_fn"
       by auto
   qed
   moreover from calculation
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp_all
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 
 lemma separation_sat_after_function3:
   assumes "[a, b, c, d]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 7"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 6" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 7" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow> fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M" and
     h_fm:  "h_fm \<in> formula" and
     h_ar:  "arity(h_fm) \<le> 8" and
     hsats: "\<And> hx gx fx x. hx\<in>M \<Longrightarrow> gx\<in>M \<Longrightarrow> fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[hx,gx,fx,x]@[a, b, c, d] \<Turnstile> h_fm) \<longleftrightarrow> hx=h(x)" and
     hclosed: "\<And>x . x\<in>M \<Longrightarrow> h(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, g(r), h(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-3)
   let ?\<phi>="\<chi>"
   let ?\<psi>="ren(?\<phi>)`7`8`ren_V3_fn"
   let ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,Exists(And(h_fm,?\<psi>))))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d,g(z), h(z)]"
   let ?env="[a, b, c, d]"
   let ?\<eta>="\<lambda>z.[h(z),g(z),f(z),z]@?env"
   note types
   moreover from this
   have "?\<phi>\<in>formula" by simp
   moreover from calculation
   have "arity(?\<phi>) \<le> 9" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_V3_thm(2)[folded ren_V3_fn_def] le_trans[of "arity(\<chi>)" 7]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 8" "?\<psi>'\<in>formula"
     using arity_ren ren_V3_thm(2)[folded ren_V3_fn_def] f_fm g_fm h_fm
     by (simp_all)
   moreover from this f_ar g_ar f_fm g_fm h_fm h_ar \<open>?\<psi>'\<in>_\<close>
   have "arity(?\<psi>') \<le> 5"
     using ord_simp_union arity_type nat_into_Ord
     by (simp add:arity,(rule_tac pred_le,simp,rule_tac Un_le,simp)+,simp_all add: \<open>?\<psi>\<in>_\<close>)
   moreover from calculation fclosed gclosed hclosed
   have 0:"(M, ?\<rho>(z) \<Turnstile> ?\<phi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of ?\<phi> 7 8 "?\<rho>(z)" M "?\<eta>(z)"]
       ren_V3_thm(1)[where A=M,folded ren_V3_fn_def,simplified] ren_V3_thm(2)[folded ren_V3_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z] gsats[of "g(z)" "f(z)" z]
       hsats[of "h(z)" "g(z)" "f(z)" z]
       fclosed gclosed hclosed f_fm g_fm h_fm
     apply(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp)
      apply(rule_tac conjI,simp,rule_tac rev_bexI[where x="g(z)"],simp)
      apply(rule_tac conjI,simp,rule_tac rev_bexI[where x="h(z)"],simp,rule_tac conjI,simp,simp)
   proof -
     assume "M, [z] @ [a, b, c, d] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> (\<cdot>\<exists>\<cdot>h_fm \<and> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn\<cdot>\<cdot>)\<cdot>\<cdot>)\<cdot>\<cdot>)"
     with calculation that
     have "\<exists>x\<in>M. (M, [x, z, a, b, c, d] \<Turnstile> f_fm) \<and>
            (\<exists>xa\<in>M. (M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm) \<and> (\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)))"
       by auto
     with calculation
     obtain x where "x\<in>M" "(M, [x, z, a, b, c, d] \<Turnstile> f_fm)"
       "(\<exists>xa\<in>M. (M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm) \<and> (\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)))"
       by force
     moreover from this
     have "x=f(z)" using fsats[of x] that by simp
     moreover from calculation
     obtain xa where "xa\<in>M" "(M, [xa, x, z, a, b, c, d] \<Turnstile> g_fm)"
       "(\<exists>xb\<in>M. (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm) \<and> (M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn))"
       by auto
     moreover from calculation
     have "xa=g(z)" using gsats[of xa x] that by simp
     moreover from calculation
     obtain xb where "xb\<in>M" "(M, [xb, xa, x, z, a, b, c, d] \<Turnstile> h_fm)"
       "(M, [xb, xa, x, z, a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn)"
       by auto
     moreover from calculation
     have "xb=h(z)" using hsats[of xb xa x] that by simp
     ultimately
     show "M, [h(z), g(z), f(z), z] @ [a, b, c, d] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V3_fn"
       by auto
   qed
   moreover from calculation \<open>?\<psi>'\<in>_\<close>
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 
 lemma separation_sat_after_function:
   assumes "[a, b, c, d, \<tau>]\<in>list(M)" and  "\<chi>\<in>formula" and "arity(\<chi>) \<le> 7"
     and
     f_fm:  "f_fm \<in> formula" and
     f_ar:  "arity(f_fm) \<le> 7" and
     fsats: "\<And> fx x. fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[fx,x]@[a, b, c, d, \<tau>] \<Turnstile> f_fm) \<longleftrightarrow> fx=f(x)" and
     fclosed: "\<And>x . x\<in>M \<Longrightarrow> f(x) \<in> M" and
     g_fm:  "g_fm \<in> formula" and
     g_ar:  "arity(g_fm) \<le> 8" and
     gsats: "\<And> gx fx x. gx\<in>M \<Longrightarrow>  fx\<in>M \<Longrightarrow> x\<in>M \<Longrightarrow> (M,[gx,fx,x]@[a, b, c, d, \<tau>] \<Turnstile> g_fm) \<longleftrightarrow> gx=g(x)" and
     gclosed: "\<And>x . x\<in>M \<Longrightarrow> g(x) \<in> M"
   shows  "separation(##M, \<lambda>r. M, [f(r), a, b, c, d, \<tau>, g(r)] \<Turnstile> \<chi>)"
 proof -
   note types = assms(1-3)
   let ?\<phi>="\<chi>"
   let ?\<psi>="ren(?\<phi>)`7`8`ren_V_fn"
   let  ?\<psi>'="Exists(And(f_fm,Exists(And(g_fm,?\<psi>))))"
   let ?\<rho>="\<lambda>z.[f(z), a, b, c, d, \<tau>, g(z)]"
   let ?env="[a, b, c, d, \<tau>]"
   let ?\<eta>="\<lambda>z.[g(z),f(z),z]@?env"
   note types
   moreover from this
   have "?\<phi>\<in>formula" by simp
   moreover from calculation
   have "arity(?\<phi>) \<le> 8" "?\<psi>\<in>formula"
     using ord_simp_union ren_tc ren_V_thm(2)[folded ren_V_fn_def] le_trans[of "arity(\<chi>)" 7]
     by simp_all
   moreover from calculation
   have "arity(?\<psi>) \<le> 8" "?\<psi>'\<in>formula"
     using arity_ren ren_V_thm(2)[folded ren_V_fn_def] f_fm g_fm
     by (simp_all)
   moreover from calculation f_ar g_ar f_fm g_fm
   have "arity(?\<psi>') \<le> 6"
     using ord_simp_union pred_le arity_type
     by (simp add:arity)
   moreover from calculation fclosed gclosed
   have 0:"(M, ?\<rho>(z) \<Turnstile> ?\<phi>) \<longleftrightarrow> (M,?\<eta>(z)\<Turnstile> ?\<psi>)" if "(##M)(z)" for z
     using sats_iff_sats_ren[of ?\<phi> 7 8 "?\<rho>(z)" _ "?\<eta>(z)"]
       ren_V_thm(1)[where A=M,folded ren_V_fn_def] ren_V_thm(2)[folded ren_V_fn_def] that
     by simp
   moreover from calculation
   have 1:"(M,?\<eta>(z)\<Turnstile> ?\<psi>) \<longleftrightarrow> M,[z]@?env\<Turnstile>?\<psi>'" if "(##M)(z)" for z
     using that fsats[OF fclosed[of z],of z]  gsats[of "g(z)" "f(z)" z]
       fclosed gclosed f_fm g_fm
     apply(rule_tac iffI,simp,rule_tac rev_bexI[where x="f(z)"],simp)
      apply(auto)[1]
   proof -
     assume "M, [z] @ [a, b, c, d, \<tau>] \<Turnstile> (\<cdot>\<exists>\<cdot>f_fm \<and> (\<cdot>\<exists>\<cdot>g_fm \<and> ren(\<chi>) ` 7 ` 8 ` ren_V_fn\<cdot>\<cdot>)\<cdot>\<cdot>)"
     then have "\<exists>xa\<in>M. (M, [xa, z, a, b, c, d, \<tau>] \<Turnstile> f_fm) \<and>
        (\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm) \<and> (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn))"
       using that calculation by auto
     then
     obtain xa where "xa\<in>M" "M, [xa, z, a, b, c, d, \<tau>] \<Turnstile> f_fm"
       "(\<exists>x\<in>M. (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm) \<and> (M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn))"
       by auto
     moreover from this
     have "xa=f(z)" using fsats[of xa] that by simp
     moreover from calculation
     obtain x where "x\<in>M" "M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> g_fm" "M, [x, xa, z, a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn"
       by auto
     moreover from calculation
     have "x=g(z)" using gsats[of x xa] that by simp
     ultimately
     show "M, [g(z), f(z), z] @ [a, b, c, d, \<tau>] \<Turnstile> ren(\<chi>) ` 7 ` 8 ` ren_V_fn"
       by auto
   qed
   moreover from calculation
   have "separation(##M, \<lambda>z. (M,[z]@?env \<Turnstile> ?\<psi>'))"
     using separation_ax
     by simp_all
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD2,OF iff_trans[OF 0 1]],clarify,force)
 qed
 end
 
 definition separation_assm_fm :: "[i,i,i] \<Rightarrow> i"
   where
   "separation_assm_fm(A,x,f_fm) \<equiv> (\<cdot>\<exists> (\<cdot>\<exists> \<cdot>\<cdot>0 \<in> A +\<^sub>\<omega> 2\<cdot> \<and> \<cdot>\<cdot>\<langle>0,1\<rangle> is x+\<^sub>\<omega> 2 \<cdot> \<and> f_fm \<cdot>\<cdot>\<cdot>)\<cdot>)" 
 
 lemma separation_assm_fm_type[TC]: 
   "A \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow> separation_assm_fm(A, y,f_fm) \<in> formula"
   unfolding separation_assm_fm_def
   by simp
 
 lemma arity_separation_assm_fm : "A \<in> \<omega> \<Longrightarrow> x \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow>
   arity(separation_assm_fm(A, x, f_fm)) = succ(A) \<union> succ(x) \<union> pred(pred(arity(f_fm)))"
   using pred_Un_distrib
   unfolding separation_assm_fm_def
   by (auto simp add:arity)
 
 definition separation_assm_bin_fm where
   "separation_assm_bin_fm(A,y,f_fm) \<equiv> 
     (\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>(\<cdot>\<cdot>3 \<in> A +\<^sub>\<omega> 4\<cdot> \<and>  \<cdot>\<langle>3,2\<rangle> is y +\<^sub>\<omega> 4\<cdot>\<cdot> ) \<and> \<cdot>f_fm \<and> \<cdot> \<cdot>fst(3) is 0 \<cdot> \<and> \<cdot>snd(3) is 1\<cdot>\<cdot>\<cdot>\<cdot> ) \<cdot>)\<cdot>)\<cdot>)\<cdot>) "
 
 lemma separation_assm_bin_fm_type[TC]: 
   "A \<in> \<omega> \<Longrightarrow> y \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow> separation_assm_bin_fm(A, y,f_fm) \<in> formula"
   unfolding separation_assm_bin_fm_def
   by simp
 
 lemma arity_separation_assm_bin_fm : "A \<in> \<omega> \<Longrightarrow> x \<in> \<omega> \<Longrightarrow> f_fm \<in> formula \<Longrightarrow>
   arity(separation_assm_bin_fm(A, x, f_fm)) = succ(A) \<union> succ(x) \<union> (pred^4(arity(f_fm)))"
   using pred_Un_distrib
   unfolding separation_assm_bin_fm_def
   by (auto simp add:arity)
 
 context M_Z_trans
 begin
 
 lemma separation_assm_sats : 
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>) = 2" and
     fsats: "\<And>env x y. env\<in>list(M) \<Longrightarrow> x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,y)" and
     fabs:  "\<And>x y. x\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)" and
     fclosed: "\<And>x. x\<in>M \<Longrightarrow> f(x) \<in> M" and
     "A\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, f(x)\<rangle>)"
 proof -
   let ?\<phi>'="separation_assm_fm(1,0,\<phi>)"
   let ?p="\<lambda>y. \<exists>x\<in>M . x\<in>A \<and> y = \<langle>x, f(x)\<rangle>"
   from f_fm
   have "?\<phi>'\<in>formula"
      by simp
   moreover from this f_ar f_fm
   have "arity(?\<phi>') = 2"
     using arity_separation_assm_fm[of 1 0 \<phi>] ord_simp_union  
     by simp
   moreover from \<open>A\<in>M\<close> calculation
   have "separation(##M,\<lambda>y . M,[y,A] \<Turnstile> ?\<phi>')"
     using separation_ax by auto
   moreover
   have "y\<in>M \<Longrightarrow> (M,[y,A] \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(y)" for y
     using assms transitivity[OF _ \<open>A\<in>M\<close>]
     unfolding separation_assm_fm_def
     by auto  
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD1],auto)
 qed
 
 lemma separation_assm_bin_sats :
   assumes
     f_fm:  "\<phi> \<in> formula" and
     f_ar:  "arity(\<phi>) = 3" and
     fsats: "\<And>env x z y. env\<in>list(M) \<Longrightarrow> x\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> (M,[x,z,y]@env \<Turnstile> \<phi>) \<longleftrightarrow> is_f(x,z,y)" and
     fabs:  "\<And>x z y. x\<in>M \<Longrightarrow>  z\<in>M \<Longrightarrow> y\<in>M \<Longrightarrow> is_f(x,z,y) \<longleftrightarrow> y = f(x,z)" and
     fclosed: "\<And>x z . x\<in>M \<Longrightarrow>  z\<in>M \<Longrightarrow> f(x,z) \<in> M" and
     "A\<in>M"
   shows "separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, f(fst(x),snd(x))\<rangle>)"
 proof -
   let ?\<phi>'="separation_assm_bin_fm(1,0,\<phi>)"
   let ?p="\<lambda>y. \<exists>x\<in>M . x\<in>A \<and> y = \<langle>x, f(fst(x),snd(x))\<rangle>"
   from f_fm
   have "?\<phi>'\<in>formula"
      by simp
   moreover from this f_ar f_fm
   have "arity(?\<phi>') = 2"
     using arity_separation_assm_bin_fm[of 1 0 \<phi>] ord_simp_union  
     by simp
   moreover from \<open>A\<in>M\<close> calculation
   have "separation(##M,\<lambda>y . M,[y,A] \<Turnstile> ?\<phi>')"
     using separation_ax by auto
   moreover
   have "y\<in>M \<Longrightarrow> (M,[y,A] \<Turnstile> ?\<phi>') \<longleftrightarrow> ?p(y)" for y
     using assms transitivity[OF _ \<open>A\<in>M\<close>] pair_in_M_iff fst_abs snd_abs fst_closed snd_closed
     unfolding separation_assm_bin_fm_def
     by auto
   ultimately
   show ?thesis
     by(rule_tac separation_cong[THEN iffD1],auto)
 qed
 
 lemma separation_Union: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, Union(x)\<rangle>)"
   using separation_assm_sats[of "big_union_fm(0,1)"] arity_big_union_fm ord_simp_union
     Union_closed[simplified]
   by simp
 
 lemma lam_replacement_Union: "lam_replacement(##M, Union)"
   using lam_replacement_Union' separation_Union transM by simp
 
 lemma separation_fst: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, fst(x)\<rangle>)"
   using separation_assm_sats[of "fst_fm(0,1)"] arity_fst_fm ord_simp_union
     fst_closed fst_abs
   by simp
 
 lemma lam_replacement_fst: "lam_replacement(##M, fst)"
   using lam_replacement_fst' separation_fst transM by simp
 
 lemma separation_snd: "A\<in>M \<Longrightarrow>
     separation(##M, \<lambda>y. \<exists>x \<in> M . x\<in>A \<and> y = \<langle>x, snd(x)\<rangle>)"
   using separation_assm_sats[of "snd_fm(0,1)"] arity_snd_fm ord_simp_union
     snd_closed[simplified] snd_abs
   by simp
 
 lemma lam_replacement_snd: "lam_replacement(##M, snd)"
   using lam_replacement_snd' separation_snd transM by simp
 
 text\<open>Binary lambda-replacements\<close>
 
 lemma separation_Image: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, fst(x) `` snd(x)\<rangle>)"
   using  arity_image_fm ord_simp_union
     nonempty image_closed image_abs
   by (rule_tac separation_assm_bin_sats[of "image_fm(0,1,2)"],auto)
 
 lemma lam_replacement_Image: "lam_replacement(##M, \<lambda>x . fst(x) `` snd(x))"
   using lam_replacement_Image' separation_Image
   by simp
 
 lemma separation_middle_del: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, middle_del(fst(x), snd(x))\<rangle>)"
  using  arity_is_middle_del_fm ord_simp_union nonempty
     fst_abs snd_abs fst_closed snd_closed pair_in_M_iff
   by (rule_tac separation_assm_bin_sats[of "is_middle_del_fm(0,1,2)"],
       auto simp:is_middle_del_def middle_del_def)
 
 lemma lam_replacement_middle_del: "lam_replacement(##M, \<lambda>r . middle_del(fst(r),snd(r)))"
   using lam_replacement_middle_del' separation_middle_del
   by simp
 
 lemma separation_prodRepl: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, prodRepl(fst(x), snd(x))\<rangle>)"
    using  arity_is_prodRepl_fm ord_simp_union nonempty
     fst_abs snd_abs fst_closed snd_closed pair_in_M_iff
   by (rule_tac separation_assm_bin_sats[of "is_prodRepl_fm(0,1,2)"],
       auto simp:is_prodRepl_def prodRepl_def)
 
 lemma lam_replacement_prodRepl: "lam_replacement(##M, \<lambda>r . prodRepl(fst(r),snd(r)))"
   using lam_replacement_prodRepl' separation_prodRepl
   by simp
 
 end  \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 context M_trivial
 begin
 
 lemma first_closed:
   "M(B) \<Longrightarrow> M(r) \<Longrightarrow> first(u,r,B) \<Longrightarrow> M(u)"
   using transM[OF first_is_elem] by simp
 
 is_iff_rel for "first"
   unfolding is_first_def first_rel_def by auto
 
 is_iff_rel for "minimum"
   unfolding is_minimum_def minimum_rel_def
   using is_first_iff The_abs nonempty
   by force
 
 end \<comment> \<open>\<^locale>\<open>M_trivial\<close>\<close>
 
 context M_Z_trans
 begin
 
 lemma (in M_basic) is_minimum_equivalence :
   "M(R) \<Longrightarrow> M(X) \<Longrightarrow> M(u) \<Longrightarrow> is_minimum(M,R,X,u) \<longleftrightarrow> is_minimum'(M,R,X,u)"
   unfolding is_minimum_def is_minimum'_def is_The_def is_first_def by simp
 
 lemma separation_minimum: "A\<in>M \<Longrightarrow>
      separation(##M, \<lambda>y. \<exists>x\<in>M. x \<in> A \<and> y = \<langle>x, minimum(fst(x), snd(x))\<rangle>)"
   using  arity_minimum_fm ord_simp_union is_minimum_iff minimum_abs
     is_minimum_equivalence nonempty minimum_closed minimum_abs
   by (rule_tac separation_assm_bin_sats[of "minimum_fm(0,1,2)"], auto)
 
 lemma lam_replacement_minimum: "lam_replacement(##M, \<lambda>x . minimum(fst(x),snd(x)))"
   using lam_replacement_minimum' separation_minimum
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_Z_trans\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Kappa_Closed_Notions.thy b/thys/Independence_CH/Kappa_Closed_Notions.thy
--- a/thys/Independence_CH/Kappa_Closed_Notions.thy
+++ b/thys/Independence_CH/Kappa_Closed_Notions.thy
@@ -1,723 +1,723 @@
 section\<open>Preservation results for $\kappa$-closed forcing notions\<close>
 
 theory Kappa_Closed_Notions
   imports
     Not_CH
 begin
 
 definition
   lerel :: "i\<Rightarrow>i" where
   "lerel(\<alpha>) \<equiv> Memrel(\<alpha>) \<union> id(\<alpha>)"
 
 lemma lerelI[intro!]: "x\<le>y \<Longrightarrow> y\<in>\<alpha> \<Longrightarrow> Ord(\<alpha>) \<Longrightarrow> \<langle>x,y\<rangle> \<in> lerel(\<alpha>)"
   using Ord_trans[of x y \<alpha>] ltD unfolding lerel_def by auto
 
 lemma lerelD[dest]: "\<langle>x,y\<rangle> \<in> lerel(\<alpha>) \<Longrightarrow> Ord(\<alpha>) \<Longrightarrow> x\<le>y"
   using ltI[THEN leI] Ord_in_Ord unfolding lerel_def by auto
 
 definition
   mono_seqspace :: "[i,i,i] \<Rightarrow> i" (\<open>_ \<^sub><\<rightarrow> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow> (P,leq) \<equiv> mono_map(\<alpha>,Memrel(\<alpha>),P,leq)"
 
 relativize functional "mono_seqspace" "mono_seqspace_rel"
 relationalize "mono_seqspace_rel" "is_mono_seqspace"
 synthesize "is_mono_seqspace" from_definition assuming "nonempty"
 
 context M_ZF_library
 begin
 
 rel_closed for "mono_seqspace"
   unfolding mono_seqspace_rel_def mono_map_rel_def
   using separation_closed separation_ball separation_imp separation_in
     lam_replacement_fst lam_replacement_snd lam_replacement_hcomp lam_replacement_constant
     lam_replacement_product
     lam_replacement_apply2[THEN[5] lam_replacement_hcomp2]
   by simp_all
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_library\<close>\<close>
 
 abbreviation
   mono_seqspace_r (\<open>_ \<^sub><\<rightarrow>\<^bsup>_\<^esup> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<equiv> mono_seqspace_rel(M,\<alpha>,P,leq)"
 
 abbreviation
   mono_seqspace_r_set (\<open>_ \<^sub><\<rightarrow>\<^bsup>_\<^esup> '(_,_')\<close> [61] 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<equiv> mono_seqspace_rel(##M,\<alpha>,P,leq)"
 
 lemma mono_seqspaceI[intro!]:
   includes mono_map_rules
   assumes "f: A\<rightarrow>P" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> \<langle>f`x, f`y\<rangle> \<in> leq" "Ord(A)"
   shows  "f: A \<^sub><\<rightarrow> (P,leq)"
   using ltI[OF _ Ord_in_Ord[of A], THEN [3] assms(2)] assms(1,3)
   unfolding mono_seqspace_def by auto
 
 lemma (in M_ZF_library) mono_seqspace_rel_char:
   assumes "M(A)" "M(P)" "M(leq)"
   shows "A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) = {f\<in>A \<^sub><\<rightarrow> (P,leq). M(f)}"
   using assms mono_map_rel_char
   unfolding mono_seqspace_def mono_seqspace_rel_def by simp
 
 lemma (in M_ZF_library) mono_seqspace_relI[intro!]:
   assumes "f: A\<rightarrow>\<^bsup>M\<^esup> P" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> \<langle>f`x, f`y\<rangle> \<in> leq"
     "Ord(A)" "M(A)" "M(P)" "M(leq)"
   shows  "f: A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq)"
   using mono_seqspace_rel_char function_space_rel_char assms by auto
 
 lemma mono_seqspace_is_fun[dest]:
   includes mono_map_rules
   shows "j: A \<^sub><\<rightarrow> (P,leq) \<Longrightarrow> j: A\<rightarrow> P"
   unfolding mono_seqspace_def by auto
 
 lemma mono_map_lt_le_is_mono[dest]:
   includes mono_map_rules
   assumes "j: A \<^sub><\<rightarrow> (P,leq)" "a\<in>A" "c\<in>A" "a\<le>c" "Ord(A)" "refl(P,leq)"
   shows "\<langle>j`a,j`c\<rangle> \<in> leq"
   using assms mono_map_increasing unfolding mono_seqspace_def refl_def
   by (cases "a=c") (auto dest:ltD)
 
 lemma (in M_ZF_library) mem_mono_seqspace_abs[absolut]:
   assumes "M(f)" "M(A)" "M(P)" "M(leq)"
   shows  "f:A \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,leq) \<longleftrightarrow>  f: A \<^sub><\<rightarrow> (P,leq)"
   using assms mono_map_rel_char unfolding mono_seqspace_def mono_seqspace_rel_def
   by (simp)
 
 definition
   mono_map_lt_le :: "[i,i] \<Rightarrow> i" (infixr \<open>\<^sub><\<rightarrow>\<^sub>\<le>\<close> 60) where
   "\<alpha> \<^sub><\<rightarrow>\<^sub>\<le> \<beta> \<equiv> \<alpha> \<^sub><\<rightarrow> (\<beta>,lerel(\<beta>))"
 
 lemma mono_map_lt_leI[intro!]:
   includes mono_map_rules
   assumes "f: A\<rightarrow>B" "\<And>x y. x\<in>A \<Longrightarrow> y\<in>A \<Longrightarrow> x<y \<Longrightarrow> f`x \<le> f`y" "Ord(A)" "Ord(B)"
   shows  "f: A \<^sub><\<rightarrow>\<^sub>\<le> B"
   using assms
   unfolding mono_map_lt_le_def by auto
 
 \<comment> \<open>Kunen IV.7.13, with “$\kappa$” in place of “$\lambda$”\<close>
 definition
   kappa_closed :: "[i,i,i] \<Rightarrow> o" (\<open>_-closed'(_,_')\<close>) where
   "\<kappa>-closed(P,leq) \<equiv> \<forall>\<delta>. \<delta><\<kappa> \<longrightarrow> (\<forall>f\<in>\<delta> \<^sub><\<rightarrow> (P,converse(leq)). \<exists>q\<in>P. \<forall>\<alpha>\<in>\<delta>. \<langle>q,f`\<alpha>\<rangle>\<in>leq)"
 
 relativize functional "kappa_closed" "kappa_closed_rel"
 relationalize "kappa_closed_rel" "is_kappa_closed"
 synthesize "is_kappa_closed" from_definition assuming "nonempty"
 
 abbreviation
   kappa_closed_r (\<open>_-closed\<^bsup>_\<^esup>'(_,_')\<close> [61] 60) where
   "\<kappa>-closed\<^bsup>M\<^esup>(P,leq) \<equiv> kappa_closed_rel(M,\<kappa>,P,leq)"
 
 abbreviation
   kappa_closed_r_set (\<open>_-closed\<^bsup>_\<^esup>'(_,_')\<close> [61] 60) where
   "\<kappa>-closed\<^bsup>M\<^esup>(P,leq) \<equiv> kappa_closed_rel(##M,\<kappa>,P,leq)"
 
 lemma (in forcing_data3) forcing_a_value:
   assumes "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]" "a \<in> A"
-    "q \<preceq> p" "q \<in> P" "p\<in>P" "f_dot \<in> M" "A\<in>M" "B\<in>M"
-  shows "\<exists>d\<in>P. \<exists>b\<in>B. d \<preceq> q \<and> d \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]"
+    "q \<preceq> p" "q \<in> \<bbbP>" "p\<in>\<bbbP>" "f_dot \<in> M" "A\<in>M" "B\<in>M"
+  shows "\<exists>d\<in>\<bbbP>. \<exists>b\<in>B. d \<preceq> q \<and> d \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]"
     (* \<comment> \<open>Old neater version, but harder to use
     (without the assumptions on \<^term>\<open>q\<close>):\<close>
-    "dense_below({q \<in> P. \<exists>b\<in>B. q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}, p)" *)
+    "dense_below({q \<in> \<bbbP>. \<exists>b\<in>B. q \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, b\<^sup>v]}, p)" *)
 proof -
   from assms
   have "q \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]"
     using strengthening_lemma[of p "\<cdot>0:1\<rightarrow>2\<cdot>" q "[f_dot, A\<^sup>v, B\<^sup>v]"]
       typed_function_type arity_typed_function_fm
     by (auto simp: union_abs2 union_abs1)
   from \<open>a\<in>A\<close> \<open>A\<in>M\<close>
   have "a\<in>M" by (auto dest:transitivity)
-  from \<open>q\<in>P\<close>
+  from \<open>q\<in>\<bbbP>\<close>
   text\<open>Here we're using countability (via the existence of generic filters)
     of \<^term>\<open>M\<close> as a shortcut, to avoid a further density argument.\<close>
   obtain G where "M_generic(G)" "q\<in>G"
     using generic_filter_existence by blast
   then
   interpret G_generic3_AC _ _ _ _ _ G by unfold_locales
   include G_generic1_lemmas
   note \<open>q\<in>G\<close>
   moreover
   note \<open>q \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, A\<^sup>v, B\<^sup>v]\<close> \<open>M_generic(G)\<close>
   moreover
-  note \<open>q\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close> \<open>A\<in>M\<close>
+  note \<open>q\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close> \<open>A\<in>M\<close>
   moreover from this
   have "map(val( G), [f_dot, A\<^sup>v, B\<^sup>v]) \<in> list(M[G])" by simp
   moreover from calculation
   have "val(G,f_dot) : A \<rightarrow>\<^bsup>M[G]\<^esup> B"
     using truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, A\<^sup>v, B\<^sup>v]", THEN iffD1]
       typed_function_type arity_typed_function_fm val_check[OF one_in_G one_in_P]
     by (auto simp: union_abs2 union_abs1 ext.mem_function_space_rel_abs)
   moreover
   note \<open>a \<in> M\<close>
   moreover from calculation and \<open>a\<in>A\<close>
   have "val(G,f_dot) ` a \<in> B" (is "?b \<in> B")
     by (simp add: ext.mem_function_space_rel_abs)
   moreover from calculation
   have "?b \<in> M" by (auto dest:transitivity)
   moreover from calculation
   have "M[G], map(val(G), [f_dot, a\<^sup>v, ?b\<^sup>v]) \<Turnstile> \<cdot>0`1 is 2\<cdot>"
     by simp
   ultimately
-  obtain r where "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, ?b\<^sup>v]" "r\<in>G" "r\<in>P"
+  obtain r where "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, ?b\<^sup>v]" "r\<in>G" "r\<in>\<bbbP>"
     using truth_lemma[of "\<cdot>0`1 is 2\<cdot>" "[f_dot, a\<^sup>v, ?b\<^sup>v]", THEN iffD2]
       fun_apply_type arity_fun_apply_fm val_check[OF one_in_G one_in_P]
       G_subset_P
     by (auto simp: union_abs2 union_abs1 ext.mem_function_space_rel_abs)
   moreover from this and \<open>q\<in>G\<close>
-  obtain d where "d\<preceq>q" "d\<preceq>r" "d\<in>P" by force
+  obtain d where "d\<preceq>q" "d\<preceq>r" "d\<in>\<bbbP>" by force
   moreover
   note \<open>f_dot\<in>M\<close> \<open>a\<in>M\<close> \<open>?b\<in>B\<close> \<open>B\<in>M\<close>
   moreover from calculation
   have "d \<preceq> q \<and> d \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, a\<^sup>v, ?b\<^sup>v]"
     using fun_apply_type arity_fun_apply_fm
       strengthening_lemma[of r "\<cdot>0`1 is 2\<cdot>" d "[f_dot, a\<^sup>v, ?b\<^sup>v]"]
     by (auto dest:transitivity simp add: union_abs2 union_abs1)
   ultimately
   show ?thesis by auto
 qed
 
 locale M_master_CH = M_master + M_library_DC
 
 sublocale M_ZFC2_ground_CH_trans \<subseteq> M_master_CH "##M"
   using replacement_dcwit_repl_body
   by unfold_locales (simp_all add:sep_instances del:setclass_iff
       add: transrec_replacement_def wfrec_replacement_def dcwit_repl_body_def)
 
 context G_generic3_AC_CH begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemma separation_check_snd_aux:
   assumes "f_dot\<in>M" "\<tau>\<in>M" "\<chi>\<in>formula" "arity(\<chi>) \<le> 7"
-  shows "separation(##M, \<lambda>r. M, [fst(r), P, leq, \<one>, f_dot, \<tau>, snd(r)\<^sup>v] \<Turnstile> \<chi>)"
+  shows "separation(##M, \<lambda>r. M, [fst(r), \<bbbP>, leq, \<one>, f_dot, \<tau>, snd(r)\<^sup>v] \<Turnstile> \<chi>)"
 proof -
   let ?f_fm="fst_fm(1,0)"
   let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
   note assms
   moreover
   have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
     using ord_simp_union
     unfolding hcomp_fm_def
     by (simp_all add:arity)
   ultimately
   show ?thesis
     using separation_sat_after_function
     using fst_abs snd_abs sats_snd_fm sats_check_fm check_abs
     unfolding hcomp_fm_def
     by simp
 qed
 
 lemma separation_check_fst_snd_aux :
   assumes "f_dot\<in>M" "r\<in>M" "\<chi>\<in>formula" "arity(\<chi>) \<le> 7"
-  shows "separation(##M, \<lambda>p. M, [r, P, leq, \<one>, f_dot, fst(p)\<^sup>v, snd(p)\<^sup>v] \<Turnstile> \<chi>)"
+  shows "separation(##M, \<lambda>p. M, [r, \<bbbP>, leq, \<one>, f_dot, fst(p)\<^sup>v, snd(p)\<^sup>v] \<Turnstile> \<chi>)"
 proof -
-  let ?\<rho>="\<lambda>z. [r, P, leq, \<one>, f_dot, fst(z)\<^sup>v, snd(z)\<^sup>v]"
-  let ?\<rho>'="\<lambda>z. [fst(z)\<^sup>v, P, leq, \<one>, f_dot, r, snd(z)\<^sup>v]"
+  let ?\<rho>="\<lambda>z. [r, \<bbbP>, leq, \<one>, f_dot, fst(z)\<^sup>v, snd(z)\<^sup>v]"
+  let ?\<rho>'="\<lambda>z. [fst(z)\<^sup>v, \<bbbP>, leq, \<one>, f_dot, r, snd(z)\<^sup>v]"
   let ?\<phi>=" (\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>(\<cdot>\<exists>\<cdot>\<cdot>0 = 11\<cdot> \<and> \<cdot>\<cdot>1 = 7\<cdot> \<and> \<cdot>\<cdot>2 = 8\<cdot> \<and> \<cdot>\<cdot>3 = 9\<cdot> \<and> \<cdot>\<cdot>4 = 10\<cdot> \<and> \<cdot>\<cdot>5 = 6\<cdot> \<and>
     (\<lambda>p. incr_bv(p)`6)^6 (\<chi>) \<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)\<cdot>)"
   let ?f_fm="hcomp_fm(check_fm(5),fst_fm,1,0)"
   let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
   note assms
   moreover
   have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
     using ord_simp_union
     unfolding hcomp_fm_def
     by (simp_all add:arity)
   moreover from assms
   have fm:"?\<phi>\<in>formula" by simp
   moreover from \<open>\<chi> \<in> formula\<close> \<open>arity(\<chi>) \<le> 7\<close>
   have "arity(\<chi>) = 0 \<or> arity(\<chi>) = 1 \<or> arity(\<chi>) = 2 \<or> arity(\<chi>) = 3
     \<or> arity(\<chi>) = 4 \<or> arity(\<chi>) = 5 \<or> arity(\<chi>) = 6 \<or> arity(\<chi>) = 7"
     unfolding lt_def by auto
   with calculation and \<open>\<chi> \<in> formula\<close>
   have ar:"arity(?\<phi>) \<le> 7"
     using arity_incr_bv_lemma by safe (simp_all add: arity ord_simp_union)
   moreover from calculation
   have sep:"separation(##M,\<lambda>z. M,?\<rho>'(z)\<Turnstile>?\<phi>)"
     using separation_sat_after_function sats_check_fm check_abs
       fst_abs snd_abs
     unfolding hcomp_fm_def
     by simp
   moreover from assms
   have "?\<rho>(z) \<in> list(M)" if "(##M)(z)" for z
     using that by simp
   moreover from calculation and \<open>r \<in> M\<close> \<open>\<chi> \<in> formula\<close>
   have "(M,?\<rho>(z) \<Turnstile> \<chi>) \<longleftrightarrow> (M,?\<rho>'(z)\<Turnstile>?\<phi>)" if "(##M)(z)" for z
     using that sats_incr_bv_iff[of _ _ M _ "[_,_,_,_,_,_]"]
     by simp
   ultimately
   show ?thesis
     using separation_cong[THEN iffD1,OF _ sep]
     by simp
 qed
 
 lemma separation_leq_and_forces_apply_aux:
   assumes "f_dot\<in>M" "B\<in>M"
   shows "\<forall>n\<in>M. separation(##M, \<lambda>x. snd(x) \<preceq> fst(x) \<and>
-          (\<exists>b\<in>B. M, [snd(x), P, leq, \<one>, f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
+          (\<exists>b\<in>B. M, [snd(x), \<bbbP>, leq, \<one>, f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
 proof -
   have pred_nat_closed: "pred(n)\<in>M" if "n\<in>M" for n
     using nat_case_closed that
     unfolding pred_def
     by auto
-  have "separation(##M, \<lambda>z. M, [snd(fst(z)), P, leq, \<one>, f_dot, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
+  have "separation(##M, \<lambda>z. M, [snd(fst(z)), \<bbbP>, leq, \<one>, f_dot, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
     if "\<chi>\<in>formula" "arity(\<chi>) \<le> 7" "\<tau>\<in>M" for \<chi> \<tau>
   proof -
     let ?f_fm="hcomp_fm(snd_fm,fst_fm,1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
     note assms
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 7" "?g_fm \<in> formula" "arity(?g_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function sats_check_fm check_abs fst_abs snd_abs that
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using separation_in lam_replacement_constant lam_replacement_snd lam_replacement_fst
       lam_replacement_product pred_nat_closed
       arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
     by(clarify,rule_tac separation_conj,simp_all,rule_tac separation_bex,simp_all)
 qed
 
 lemma separation_leq_and_forces_apply_aux':
   assumes "f_dot\<in>M" "p\<in>M" "B\<in>M"
   shows "separation
      (##M, \<lambda>p .  snd(snd(p)) \<preceq> fst(snd(p)) \<and>
-    (\<exists>b\<in>B. M, [snd(snd(p)), P, leq, \<one>, f_dot, (\<Union>fst(p))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
+    (\<exists>b\<in>B. M, [snd(snd(p)), \<bbbP>, leq, \<one>, f_dot, (\<Union>fst(p))\<^sup>v, b\<^sup>v] \<Turnstile> forces(\<cdot>0`1 is 2\<cdot> )))"
 proof -
-  have "separation(##M, \<lambda>z. M, [snd(snd(fst(z))), P, leq, \<one>, f_dot, (\<Union>fst(fst(z)))\<^sup>v, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
+  have "separation(##M, \<lambda>z. M, [snd(snd(fst(z))), \<bbbP>, leq, \<one>, f_dot, (\<Union>fst(fst(z)))\<^sup>v, snd(z)\<^sup>v] \<Turnstile> \<chi>)"
     if "\<chi>\<in>formula" "arity(\<chi>) \<le> 7" for \<chi>
   proof -
     let ?f_fm="hcomp_fm(snd_fm,hcomp_fm(snd_fm,fst_fm),1,0)"
     let ?g="\<lambda>z . (\<Union>(fst(fst(z))))\<^sup>v"
     let ?g_fm="hcomp_fm(check_fm(6),hcomp_fm(big_union_fm,hcomp_fm(fst_fm,fst_fm)),2,0)"
     let ?h_fm="hcomp_fm(check_fm(7),snd_fm,3,0)"
     note assms
     moreover
     have f_fm_facts:"?f_fm \<in> formula" "arity(?f_fm) \<le> 6"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     moreover from assms
     have "?g_fm \<in> formula" "arity(?g_fm) \<le> 7" "?h_fm \<in> formula" "arity(?h_fm) \<le> 8"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function3[OF _ _ _ f_fm_facts] check_abs
         sats_check_fm that fst_abs snd_abs sats_fst_fm sats_snd_fm
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using
       separation_conj separation_bex
       lam_replacement_constant lam_replacement_hcomp
       lam_replacement_fst lam_replacement_snd
       arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
       separation_in[OF _ lam_replacement_product]
     by simp
 qed
 
 lemma separation_closed_leq_and_forces_eq_check_aux :
   assumes "A\<in>M" "r\<in>G" "\<tau> \<in> M"
-  shows "(##M)({q\<in>P. \<exists>h\<in>A. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]})"
+  shows "(##M)({q\<in>\<bbbP>. \<exists>h\<in>A. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]})"
 proof -
-  have "separation(##M, \<lambda>z. M, [fst(z), P, leq, \<one>, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)" if
+  have "separation(##M, \<lambda>z. M, [fst(z), \<bbbP>, leq, \<one>, \<tau>, snd(z)\<^sup>v] \<Turnstile> \<chi>)" if
     "\<chi>\<in>formula" "arity(\<chi>) \<le> 6" for \<chi>
   proof -
     let ?f_fm="fst_fm(1,0)"
     let ?g_fm="hcomp_fm(check_fm(6),snd_fm,2,0)"
     note assms
     moreover
     have "?f_fm \<in> formula" "arity(?f_fm) \<le> 6" "?g_fm \<in> formula" "arity(?g_fm) \<le> 7"
       using ord_simp_union
       unfolding hcomp_fm_def
       by (simp_all add:arity)
     ultimately
     show ?thesis
       using separation_sat_after_function_1 sats_fst_fm that
         fst_abs snd_abs sats_snd_fm sats_check_fm check_abs
       unfolding hcomp_fm_def
       by simp
   qed
   with assms
   show ?thesis
     using separation_conj separation_in G_subset_M[THEN subsetD]
       lam_replacement_constant lam_replacement_fst lam_replacement_product
       arity_forces[of "\<cdot>0 = 1\<cdot>",simplified] ord_simp_union
     by(rule_tac separation_closed[OF separation_bex],simp_all)
 qed
 
 lemma separation_closed_forces_apply_aux:
   assumes "B\<in>M" "f_dot\<in>M" "r\<in>M"
   shows "(##M)({\<langle>n,b\<rangle> \<in> \<omega> \<times> B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]})"
   using nat_in_M assms transitivity[OF _ \<open>B\<in>M\<close>] nat_into_M separation_check_fst_snd_aux
     arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm[of 0 1 2] ord_simp_union
   unfolding split_def
   by simp_all
 
 \<comment> \<open>Kunen IV.6.9 (3)$\Rightarrow$(2), with general domain.\<close>
 lemma kunen_IV_6_9_function_space_rel_eq:
-  assumes "\<And>p \<tau>. p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [\<tau>, A\<^sup>v, B\<^sup>v] \<Longrightarrow> p\<in>P \<Longrightarrow> \<tau> \<in> M \<Longrightarrow>
-    \<exists>q\<in>P. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> p \<and>  q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "A\<in>M" "B\<in>M"
+  assumes "\<And>p \<tau>. p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [\<tau>, A\<^sup>v, B\<^sup>v] \<Longrightarrow> p\<in>\<bbbP> \<Longrightarrow> \<tau> \<in> M \<Longrightarrow>
+    \<exists>q\<in>\<bbbP>. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> p \<and>  q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "A\<in>M" "B\<in>M"
   shows
     "A \<rightarrow>\<^bsup>M\<^esup> B = A \<rightarrow>\<^bsup>M[G]\<^esup> B"
 proof (intro equalityI; clarsimp simp add:
     assms function_space_rel_char ext.function_space_rel_char)
   fix f
   assume "f \<in> A \<rightarrow> B" "f \<in> M[G]"
   moreover from this
   obtain \<tau> where "val(G,\<tau>) = f" "\<tau> \<in> M"
     using GenExtD by force
   moreover from calculation and \<open>A\<in>M\<close> \<open>B\<in>M\<close>
   obtain r where "r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [\<tau>, A\<^sup>v, B\<^sup>v]" "r\<in>G"
     using truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[\<tau>, A\<^sup>v, B\<^sup>v]"]
       typed_function_type arity_typed_function_fm val_check[OF one_in_G one_in_P]
     by (auto simp: union_abs2 union_abs1)
   moreover from \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>r\<in>G\<close> \<open>\<tau> \<in> M\<close>
-  have "{q\<in>P. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]} \<in> M" (is "?D \<in> M")
+  have "{q\<in>\<bbbP>. \<exists>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B. q \<preceq> r \<and> q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]} \<in> M" (is "?D \<in> M")
     using separation_closed_leq_and_forces_eq_check_aux by auto
   moreover from calculation and assms(2-)
   have "dense_below(?D, r)"
     using strengthening_lemma[of r "\<cdot>0:1\<rightarrow>2\<cdot>" _ "[\<tau>, A\<^sup>v, B\<^sup>v]", THEN assms(1)[of _ \<tau>]]
       leq_transD generic_dests(1)[of r]
     by (auto simp: union_abs2 union_abs1 typed_function_type arity_typed_function_fm) blast
   moreover from calculation
-  obtain q h where "h\<in>A \<rightarrow>\<^bsup>M\<^esup> B" "q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "q \<preceq> r" "q\<in>P" "q\<in>G"
+  obtain q h where "h\<in>A \<rightarrow>\<^bsup>M\<^esup> B" "q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]" "q \<preceq> r" "q\<in>\<bbbP>" "q\<in>G"
     using generic_inter_dense_below[of ?D r] by blast
   note \<open>q \<tturnstile> \<cdot>0 = 1\<cdot> [\<tau>, h\<^sup>v]\<close> \<open>\<tau>\<in>M\<close> \<open>h\<in>A \<rightarrow>\<^bsup>M\<^esup> B\<close> \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>q\<in>G\<close>
   moreover from this
   have "map(val(G), [\<tau>, h\<^sup>v]) \<in> list(M[G])" "h\<in>M"
     by (auto dest:transitivity)
   ultimately
   have "h = f"
     using truth_lemma[of "\<cdot>0=1\<cdot>" "[\<tau>, h\<^sup>v]"] val_check[OF one_in_G one_in_P]
     by (auto simp: ord_simp_union)
   with \<open>h\<in>M\<close>
   show "f \<in> M" by simp
 qed
 
 subsection\<open>$(\omega+1)$-Closed notions preserve countable sequences\<close>
 
 \<comment> \<open>Kunen IV.7.15, only for countable sequences\<close>
 lemma succ_omega_closed_imp_no_new_nat_sequences:
-  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)" "f : \<omega> \<rightarrow> B" "f\<in>M[G]" "B\<in>M"
+  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(\<bbbP>,leq)" "f : \<omega> \<rightarrow> B" "f\<in>M[G]" "B\<in>M"
   shows "f\<in>M"
 proof -
   (* Nice jEdit folding level to read this: 7 *)
   text\<open>The next long block proves that the assumptions of Lemma
   @{thm [source] kunen_IV_6_9_function_space_rel_eq} are satisfied.\<close>
   {
     fix p f_dot
-    assume "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]" "p\<in>P" "f_dot\<in>M"
-    let ?subp="{q\<in>P. q \<preceq> p}"
-    from \<open>p\<in>P\<close>
+    assume "p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]" "p\<in>\<bbbP>" "f_dot\<in>M"
+    let ?subp="{q\<in>\<bbbP>. q \<preceq> p}"
+    from \<open>p\<in>\<bbbP>\<close>
     have "?subp \<in> M"
-      using first_section_closed[of P p "converse(leq)"]
+      using first_section_closed[of \<bbbP> p "converse(leq)"]
       by (auto dest:transitivity)
     define S where "S \<equiv> \<lambda>n\<in>nat.
     {\<langle>q,r\<rangle> \<in> ?subp\<times>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v])}"
       (is "S \<equiv> \<lambda>n\<in>nat. ?Y(n)")
     define S' where "S' \<equiv> \<lambda>n\<in>nat.
     {\<langle>q,r\<rangle> \<in> ?subp\<times>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (pred(n))\<^sup>v, b\<^sup>v])}"
       \<comment> \<open>Towards proving \<^term>\<open>S\<in>M\<close>.\<close>
     moreover
     have "S = S'"
       unfolding S_def S'_def using pred_nat_eq lam_cong by auto
     moreover from \<open>B\<in>M\<close> \<open>?subp\<in>M\<close> \<open>f_dot\<in>M\<close>
     have "{r \<in> ?subp. \<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (\<Union>(n))\<^sup>v, b\<^sup>v]} \<in> M" (is "?X(n) \<in> M")
       if "n\<in>\<omega>" for n
       using that separation_check_snd_aux nat_into_M ord_simp_union
         arity_forces[of " \<cdot>0`1 is 2\<cdot>"] arity_fun_apply_fm
       by(rule_tac separation_closed[OF separation_bex,simplified], simp_all)
     moreover
     have "?Y(n) = (?subp \<times> ?X(n)) \<inter> converse(leq)" for n
       by (intro equalityI) auto
     moreover
-    note \<open>?subp \<in> M\<close> \<open>B\<in>M\<close> \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close>
+    note \<open>?subp \<in> M\<close> \<open>B\<in>M\<close> \<open>p\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close>
     moreover from calculation
     have "n \<in> \<omega> \<Longrightarrow> ?Y(n) \<in> M" for n
       using nat_into_M by simp
     moreover from calculation
     have "S \<in> M"
       using  separation_leq_and_forces_apply_aux separation_leq_and_forces_apply_aux'
-        transitivity[OF \<open>p\<in>P\<close>]
+        transitivity[OF \<open>p\<in>\<bbbP>\<close>]
       unfolding S_def split_def
       by(rule_tac lam_replacement_Collect'[THEN lam_replacement_imp_lam_closed,simplified], simp_all)
     ultimately
     have "S' \<in> M"
       by simp
-    from \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>B\<in>M\<close>
-    have exr:"\<exists>r\<in>P. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v])"
-      if "q \<preceq> p" "q\<in>P" "n\<in>\<omega>" for q n
+    from \<open>p\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close> \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>B\<in>M\<close>
+    have exr:"\<exists>r\<in>\<bbbP>. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v])"
+      if "q \<preceq> p" "q\<in>\<bbbP>" "n\<in>\<omega>" for q n
       using that forcing_a_value by (auto dest:transitivity)
     have "\<forall>q\<in>?subp. \<forall>n\<in>\<omega>. \<exists>r\<in>?subp. \<langle>q,r\<rangle> \<in> S'`n"
     proof -
       {
         fix q n
         assume "q \<in> ?subp" "n\<in>\<omega>"
         moreover from this
-        have "q \<preceq> p" "q \<in> P" "pred(n) = \<Union>n"
+        have "q \<preceq> p" "q \<in> \<bbbP>" "pred(n) = \<Union>n"
           using pred_nat_eq by simp_all
         moreover from calculation and exr
-        obtain r where MM:"r \<preceq> q" "\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v]" "r\<in>P"
+        obtain r where MM:"r \<preceq> q" "\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, pred(n)\<^sup>v, b\<^sup>v]" "r\<in>\<bbbP>"
           by blast
-        moreover from calculation \<open>q \<preceq> p\<close> \<open>p \<in> P\<close>
+        moreover from calculation \<open>q \<preceq> p\<close> \<open>p \<in> \<bbbP>\<close>
         have "r \<preceq> p"
           using leq_transD[of r q p] by auto
         ultimately
         have "\<exists>r\<in>?subp. r \<preceq> q \<and> (\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, (pred(n))\<^sup>v, b\<^sup>v])"
           by auto
       }
       then
       show ?thesis
         unfolding S'_def by simp
     qed
-    with \<open>p\<in>P\<close> \<open>?subp \<in> M\<close> \<open>S' \<in> M\<close>
+    with \<open>p\<in>\<bbbP>\<close> \<open>?subp \<in> M\<close> \<open>S' \<in> M\<close>
     obtain g where "g \<in> \<omega> \<rightarrow>\<^bsup>M\<^esup> ?subp" "g`0 = p" "\<forall>n \<in> nat. \<langle>g`n,g`succ(n)\<rangle>\<in>S'`succ(n)"
       using sequence_DC[simplified] refl_leq[of p] by blast
     moreover from this and \<open>?subp \<in> M\<close>
-    have "g : \<omega> \<rightarrow> P" "g \<in> M"
-      using fun_weaken_type[of g \<omega> ?subp P] function_space_rel_char by auto
+    have "g : \<omega> \<rightarrow> \<bbbP>" "g \<in> M"
+      using fun_weaken_type[of g \<omega> ?subp \<bbbP>] function_space_rel_char by auto
     ultimately
-    have "g : \<omega> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (P,converse(leq))"
+    have "g : \<omega> \<^sub><\<rightarrow>\<^bsup>M\<^esup> (\<bbbP>,converse(leq))"
       using decr_succ_decr[of g] leq_preord
       unfolding S'_def by (auto simp:absolut intro:leI)
-    moreover from \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)\<close> and this
-    have "\<exists>q\<in>M. q \<in> P \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> \<omega> \<longrightarrow> q \<preceq> g ` \<alpha>)"
+    moreover from \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(\<bbbP>,leq)\<close> and this
+    have "\<exists>q\<in>M. q \<in> \<bbbP> \<and> (\<forall>\<alpha>\<in>M. \<alpha> \<in> \<omega> \<longrightarrow> q \<preceq> g ` \<alpha>)"
       using transitivity[simplified, of g] mono_seqspace_rel_closed[of \<omega> _ "converse(leq)"]
       unfolding kappa_closed_rel_def
       by auto
     ultimately
-    obtain r where "r\<in>P" "r\<in>M" "\<forall>n\<in>\<omega>. r \<preceq> g`n"
+    obtain r where "r\<in>\<bbbP>" "r\<in>M" "\<forall>n\<in>\<omega>. r \<preceq> g`n"
       using nat_into_M by auto
     with \<open>g`0 = p\<close>
     have "r \<preceq> p"
       by blast
     let ?h="{\<langle>n,b\<rangle> \<in> \<omega> \<times> B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]}"
     have "function(?h)"
     proof (rule_tac functionI, rule_tac ccontr, auto simp del: app_Cons)
       fix n b b'
       assume "n \<in> \<omega>" "b \<noteq> b'" "b \<in> B" "b' \<in> B"
       moreover
       assume "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b'\<^sup>v]"
       moreover
-      note \<open>r \<in> P\<close>
+      note \<open>r \<in> \<bbbP>\<close>
       moreover from this
       have "\<not> r \<bottom> r"
         by (auto intro!:refl_leq)
       moreover
       note \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
       ultimately
       show False
         using forces_neq_apply_imp_incompatible[of r f_dot "n\<^sup>v" b r b']
           transitivity[of _ B] by (auto dest:transitivity)
     qed
     moreover
     have "range(?h) \<subseteq> B"
       by auto
     moreover
     have "domain(?h) = \<omega>"
     proof -
       {
         fix n
         assume "n \<in> \<omega>"
         moreover from this
         have 1:"(\<Union>(n)) = pred(n)"
           using pred_nat_eq by simp
         moreover from calculation and \<open>\<forall>n \<in> nat. \<langle>g`n,g`succ(n)\<rangle>\<in>S'`succ(n)\<close>
         obtain b where "g`(succ(n)) \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "b\<in>B"
           unfolding S'_def by auto
         moreover from \<open>B\<in>M\<close> and calculation
         have "b \<in> M" "n \<in> M"
           by (auto dest:transitivity)
         moreover
-        note \<open>g : \<omega> \<rightarrow> P\<close> \<open>\<forall>n\<in>\<omega>. r \<preceq> g`n\<close> \<open>r\<in>P\<close> \<open>f_dot\<in>M\<close>
+        note \<open>g : \<omega> \<rightarrow> \<bbbP>\<close> \<open>\<forall>n\<in>\<omega>. r \<preceq> g`n\<close> \<open>r\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close>
         moreover from calculation
         have "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]"
           using fun_apply_type arity_fun_apply_fm
             strengthening_lemma[of "g`succ(n)" "\<cdot>0`1 is 2\<cdot>" r "[f_dot, n\<^sup>v, b\<^sup>v]"]
           by (simp add: union_abs2 union_abs1)
         ultimately
         have "\<exists>b\<in>B. r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]"
           by auto
       }
       then
       show ?thesis
         by force
     qed
     moreover
     have "relation(?h)"
       unfolding relation_def by simp
     moreover from \<open>f_dot\<in>M\<close> \<open>r\<in>M\<close> \<open>B\<in>M\<close>
     have "?h \<in> M"
       using separation_closed_forces_apply_aux by simp
     moreover
     note \<open>B \<in> M\<close>
     ultimately
     have "?h: \<omega> \<rightarrow>\<^bsup>M\<^esup> B"
       using function_imp_Pi[THEN fun_weaken_type[of ?h _ "range(?h)" B]]
         function_space_rel_char by simp
     moreover
-    note \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>r \<preceq> p\<close> \<open>r\<in>P\<close> \<open>p\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
+    note \<open>p \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close> \<open>r \<preceq> p\<close> \<open>r\<in>\<bbbP>\<close> \<open>p\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
     moreover from this
     have "r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]"
       using strengthening_lemma[of p "\<cdot>0:1\<rightarrow>2\<cdot>" r "[f_dot, \<omega>\<^sup>v, B\<^sup>v]"]
         typed_function_type arity_typed_function_fm
       by (auto simp: union_abs2 union_abs1)
     moreover
     note \<open>?h\<in>M\<close>
     moreover from calculation
     have "r \<tturnstile> \<cdot>0 = 1\<cdot> [f_dot, ?h\<^sup>v]"
     proof (intro definition_of_forcing[THEN iffD2] allI impI,
         simp_all add:union_abs2 union_abs1 del:app_Cons)
       fix H
       let ?f="val(H,f_dot)"
       assume "M_generic(H) \<and> r \<in> H"
       moreover from this
       interpret g:G_generic1 _ _ _ _ _ H
         by unfold_locales simp
-      note \<open>r\<in>P\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
+      note \<open>r\<in>\<bbbP>\<close> \<open>f_dot\<in>M\<close> \<open>B\<in>M\<close>
       moreover from calculation
       have "map(val(H), [f_dot, \<omega>\<^sup>v, B\<^sup>v]) \<in> list(M[H])" "r\<in>H"
         by simp_all
       moreover from calculation and \<open>r\<in>H\<close> and \<open>r \<tturnstile> \<cdot>0:1\<rightarrow>2\<cdot> [f_dot, \<omega>\<^sup>v, B\<^sup>v]\<close>
       have "?f : \<omega> \<rightarrow> B"
         using g.truth_lemma[of "\<cdot>0:1\<rightarrow>2\<cdot>" "[f_dot, \<omega>\<^sup>v, B\<^sup>v]",THEN iffD1] g.one_in_G one_in_P
           typed_function_type arity_typed_function_fm val_check
         by (auto simp: union_abs2 union_abs1)
       moreover
       have "?h`n = ?f`n" if "n \<in> \<omega>" for n
       proof -
         note \<open>n \<in> \<omega>\<close> \<open>domain(?h) = \<omega>\<close>
         moreover from this
         have "n\<in>domain(?h)"
           by simp
         moreover from this
         obtain b where "r \<tturnstile> \<cdot>0`1 is 2\<cdot> [f_dot, n\<^sup>v, b\<^sup>v]" "b\<in>B"
           by force
         moreover
         note \<open>function(?h)\<close>
         moreover from calculation
         have "b = ?h`n"
           using function_apply_equality by simp
         moreover
         note \<open>B \<in> M\<close>
         moreover from calculation
         have "?h`n \<in> M"
           by (auto dest:transitivity)
         moreover
-        note \<open>f_dot \<in> M\<close> \<open>r \<in> P\<close> \<open>M_generic(H) \<and> r \<in> H\<close> \<open>map(val(H), [f_dot, \<omega>\<^sup>v, B\<^sup>v]) \<in> list(M[H])\<close>
+        note \<open>f_dot \<in> M\<close> \<open>r \<in> \<bbbP>\<close> \<open>M_generic(H) \<and> r \<in> H\<close> \<open>map(val(H), [f_dot, \<omega>\<^sup>v, B\<^sup>v]) \<in> list(M[H])\<close>
         moreover from calculation
         have "[?f, n, ?h`n] \<in> list(M[H])"
           using M_subset_MG nat_into_M[of n] g.one_in_G by (auto dest:transitivity)
         ultimately
         show ?thesis
           using definition_of_forcing[of r "\<cdot>0`1 is 2\<cdot>" "[f_dot, n\<^sup>v, b\<^sup>v]",
               THEN iffD1, rule_format, of H]\<comment> \<open>without this line is slower\<close>
             val_check g.one_in_G one_in_P nat_into_M
           by (auto dest:transitivity simp add:fun_apply_type
               arity_fun_apply_fm union_abs2 union_abs1)
       qed
       with calculation and \<open>B\<in>M\<close> \<open>?h: \<omega> \<rightarrow>\<^bsup>M\<^esup> B\<close>
       have "?h = ?f"
         using function_space_rel_char
         by (rule_tac fun_extension[of ?h \<omega> "\<lambda>_.B" ?f]) auto
       ultimately
       show "?f = val(H, ?h\<^sup>v)"
         using val_check g.one_in_G one_in_P generic by simp
     qed
     ultimately
-    have "\<exists>r\<in>P. \<exists>h\<in>\<omega> \<rightarrow>\<^bsup>M\<^esup> B. r \<preceq> p \<and> r \<tturnstile> \<cdot>0 = 1\<cdot> [f_dot, h\<^sup>v]"
+    have "\<exists>r\<in>\<bbbP>. \<exists>h\<in>\<omega> \<rightarrow>\<^bsup>M\<^esup> B. r \<preceq> p \<and> r \<tturnstile> \<cdot>0 = 1\<cdot> [f_dot, h\<^sup>v]"
       by blast
   }
   moreover
   note \<open>B \<in> M\<close> assms
   moreover from calculation
   have "f : \<omega> \<rightarrow>\<^bsup>M\<^esup> B"
     using kunen_IV_6_9_function_space_rel_eq function_space_rel_char
       ext.mem_function_space_rel_abs by auto
   ultimately
   show ?thesis
     by (auto dest:transitivity)
 qed
 
 declare mono_seqspace_rel_closed[rule del]
   \<comment> \<open>Mysteriously breaks the end of the next proof\<close>
 
 lemma succ_omega_closed_imp_no_new_reals:
-  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)"
+  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(\<bbbP>,leq)"
   shows "\<omega> \<rightarrow>\<^bsup>M\<^esup> 2 = \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"
 proof -
   from assms
   have "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2 \<subseteq> \<omega> \<rightarrow>\<^bsup>M\<^esup> 2"
     using succ_omega_closed_imp_no_new_nat_sequences function_space_rel_char
       ext.function_space_rel_char Aleph_rel_succ Aleph_rel_zero
     by auto
   then
   show ?thesis
     using function_space_rel_transfer by (intro equalityI) auto
 qed
 
 lemma succ_omega_closed_imp_Aleph_1_preserved:
-  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)"
+  assumes "succ(\<omega>)-closed\<^bsup>M\<^esup>(\<bbbP>,leq)"
   shows "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> = \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>"
 proof -
   have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
   proof (rule ccontr)
     assume "\<not> \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"
     then
     have "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup> < \<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup>"
       \<comment> \<open>Ridiculously complicated proof\<close>
       using Card_rel_is_Ord ext.Card_rel_is_Ord
         not_le_iff_lt[THEN iffD1] by auto
     then
     have "|\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>|\<^bsup>M[G]\<^esup> \<le> \<omega>"
       using ext.Card_rel_lt_csucc_rel_iff ext.Aleph_rel_zero
         ext.Aleph_rel_succ ext.Card_rel_nat
       by (auto intro!:ext.lt_csucc_rel_iff[THEN iffD1]
           intro:Card_rel_Aleph_rel[THEN Card_rel_is_Ord, of 1])
     then
     obtain f where "f \<in> inj(\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>,\<omega>)" "f \<in> M[G]"
       using ext.countable_rel_iff_cardinal_rel_le_nat[of "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>", THEN iffD2]
       unfolding countable_rel_def lepoll_rel_def
       by auto
     then
     obtain g where "g \<in> surj\<^bsup>M[G]\<^esup>(\<omega>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)"
       using ext.inj_rel_imp_surj_rel[of f _ \<omega>, OF _ zero_lt_Aleph_rel1[THEN ltD]]
       by auto
     moreover from this
     have "g : \<omega> \<rightarrow> \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>" "g \<in> M[G]"
       using ext.surj_rel_char surj_is_fun by simp_all
     moreover
-    note \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(P,leq)\<close>
+    note \<open>succ(\<omega>)-closed\<^bsup>M\<^esup>(\<bbbP>,leq)\<close>
     ultimately
     have "g \<in> surj\<^bsup>M\<^esup>(\<omega>, \<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>)" "g \<in> M"
       using succ_omega_closed_imp_no_new_nat_sequences
         mem_surj_abs ext.mem_surj_abs by simp_all
     then
     show False
       using surj_rel_implies_cardinal_rel_le[of g \<omega> "\<aleph>\<^bsub>1\<^esub>\<^bsup>M\<^esup>"]
         Card_rel_nat[THEN Card_rel_cardinal_rel_eq] Card_rel_is_Ord
         not_le_iff_lt[THEN iffD2, OF _ _ nat_lt_Aleph_rel1]
       by simp
   qed
   then
   show ?thesis
     using Aleph_rel_le_Aleph_rel
     by (rule_tac le_anti_sym) simp
 qed
 
 end \<comment> \<open>bundle G\_generic1\_lemmas\<close>
 
 end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Names.thy b/thys/Independence_CH/Names.thy
--- a/thys/Independence_CH/Names.thy
+++ b/thys/Independence_CH/Names.thy
@@ -1,637 +1,637 @@
 section\<open>Names and generic extensions\<close>
 
 theory Names
   imports
     Forcing_Data
     FrecR_Arities
     ZF_Trans_Interpretations
 begin
 
 definition
   Hv :: "[i,i,i]\<Rightarrow>i" where
   "Hv(G,x,f) \<equiv> { z . y\<in> domain(x), (\<exists>p\<in>G. \<langle>y,p\<rangle> \<in> x) \<and> z=f`y}"
 
 text\<open>The funcion \<^term>\<open>val\<close> interprets a name in \<^term>\<open>M\<close>
 according to a (generic) filter \<^term>\<open>G\<close>. Note the definition
 in terms of the well-founded recursor.\<close>
 
 definition
   val :: "[i,i]\<Rightarrow>i" where
   "val(G,\<tau>) \<equiv> wfrec(edrel(eclose({\<tau>})), \<tau> ,Hv(G))"
 
 definition
   GenExt :: "[i,i]\<Rightarrow>i"     ("_[_]" [71,1])
   where "M[G] \<equiv> {val(G,\<tau>). \<tau> \<in> M}"
 
 lemma map_val_in_MG:
   assumes
     "env\<in>list(M)"
   shows
     "map(val(G),env)\<in>list(M[G])"
   unfolding GenExt_def using assms map_type2 by simp
 
 subsection\<open>Values and check-names\<close>
 context forcing_data1
 begin
 
 lemma name_components_in_M:
   assumes "\<langle>\<sigma>,p\<rangle>\<in>\<theta>" "\<theta> \<in> M"
   shows   "\<sigma>\<in>M" "p\<in>M"
   using assms transitivity pair_in_M_iff
   by auto
 
 definition
   Hcheck :: "[i,i] \<Rightarrow> i" where
   "Hcheck(z,f)  \<equiv> { \<langle>f`y,\<one>\<rangle> . y \<in> z}"
 
 definition
   check :: "i \<Rightarrow> i" where
   "check(x) \<equiv> transrec(x , Hcheck)"
 
 lemma checkD:
   "check(x) =  wfrec(Memrel(eclose({x})), x, Hcheck)"
   unfolding check_def transrec_def ..
 
 lemma Hcheck_trancl:"Hcheck(y, restrict(f,Memrel(eclose({x}))-``{y}))
                    = Hcheck(y, restrict(f,(Memrel(eclose({x}))^+)-``{y}))"
   unfolding Hcheck_def
   using restrict_trans_eq by simp
 
 lemma check_trancl: "check(x) = wfrec(rcheck(x), x, Hcheck)"
   using checkD wf_eq_trancl Hcheck_trancl unfolding rcheck_def by simp
 
 lemma rcheck_in_M : "x \<in> M \<Longrightarrow> rcheck(x) \<in> M"
   unfolding rcheck_def by (simp flip: setclass_iff)
 
 lemma rcheck_subset_M : "x \<in> M \<Longrightarrow> field(rcheck(x)) \<subseteq> eclose({x})"
   unfolding rcheck_def using field_Memrel field_trancl by auto
 
 lemma  aux_def_check: "x \<in> y \<Longrightarrow>
   wfrec(Memrel(eclose({y})), x, Hcheck) =
   wfrec(Memrel(eclose({x})), x, Hcheck)"
   by (rule wfrec_eclose_eq,auto simp add: arg_into_eclose eclose_sing)
 
 lemma def_check : "check(y) = { \<langle>check(w),\<one>\<rangle> . w \<in> y}"
 proof -
   let
     ?r="\<lambda>y. Memrel(eclose({y}))"
   have wfr:   "\<forall>w . wf(?r(w))"
     using wf_Memrel ..
   then
   have "check(y)= Hcheck( y, \<lambda>x\<in>?r(y) -`` {y}. wfrec(?r(y), x, Hcheck))"
     using wfrec[of "?r(y)" y "Hcheck"] checkD by simp
   also
   have " ... = Hcheck( y, \<lambda>x\<in>y. wfrec(?r(y), x, Hcheck))"
     using under_Memrel_eclose arg_into_eclose by simp
   also
   have " ... = Hcheck( y, \<lambda>x\<in>y. check(x))"
     using aux_def_check checkD by simp
   finally
   show ?thesis
     using Hcheck_def by simp
 qed
 
 lemma def_checkS :
   fixes n
   assumes "n \<in> nat"
   shows "check(succ(n)) = check(n) \<union> {\<langle>check(n),\<one>\<rangle>}"
 proof -
   have "check(succ(n)) = {\<langle>check(i),\<one>\<rangle> . i \<in> succ(n)} "
     using def_check by blast
   also
   have "... = {\<langle>check(i),\<one>\<rangle> . i \<in> n} \<union> {\<langle>check(n),\<one>\<rangle>}"
     by blast
   also
   have "... = check(n) \<union> {\<langle>check(n),\<one>\<rangle>}"
     using def_check[of n,symmetric] by simp
   finally
   show ?thesis .
 qed
 
 lemma field_Memrel2 :
   assumes "x \<in> M"
   shows "field(Memrel(eclose({x}))) \<subseteq> M"
 proof -
   have "field(Memrel(eclose({x}))) \<subseteq> eclose({x})" "eclose({x}) \<subseteq> M"
     using Ordinal.Memrel_type field_rel_subset assms eclose_least[OF trans_M] by auto
   then
   show ?thesis
     using subset_trans by simp
 qed
 
 lemma aux_def_val:
   assumes "z \<in> domain(x)"
   shows "wfrec(edrel(eclose({x})),z,Hv(G)) = wfrec(edrel(eclose({z})),z,Hv(G))"
 proof -
   let ?r="\<lambda>x . edrel(eclose({x}))"
   have "z\<in>eclose({z})"
     using arg_in_eclose_sing .
   moreover
   have "relation(?r(x))"
     using relation_edrel .
   moreover
   have "wf(?r(x))"
     using wf_edrel .
   moreover from assms
   have "tr_down(?r(x),z) \<subseteq> eclose({z})"
     using tr_edrel_subset by simp
   ultimately
   have "wfrec(?r(x),z,Hv(G)) = wfrec[eclose({z})](?r(x),z,Hv(G))"
     using wfrec_restr by simp
   also from \<open>z\<in>domain(x)\<close>
   have "... = wfrec(?r(z),z,Hv(G))"
     using restrict_edrel_eq wfrec_restr_eq by simp
   finally
   show ?thesis .
 qed
 
 text\<open>The next lemma provides the usual recursive expresion for the definition of \<^term>\<open>val\<close>.\<close>
 
 lemma def_val:  "val(G,x) = {z . t\<in>domain(x) , (\<exists>p\<in>G .  \<langle>t,p\<rangle>\<in>x) \<and> z=val(G,t)}"
 proof -
   let
     ?r="\<lambda>\<tau> . edrel(eclose({\<tau>}))"
   let
     ?f="\<lambda>z\<in>?r(x)-``{x}. wfrec(?r(x),z,Hv(G))"
   have "\<forall>\<tau>. wf(?r(\<tau>))"
     using wf_edrel by simp
   with wfrec [of _ x]
   have "val(G,x) = Hv(G,x,?f)"
     using val_def by simp
   also
   have " ... = Hv(G,x,\<lambda>z\<in>domain(x). wfrec(?r(x),z,Hv(G)))"
     using dom_under_edrel_eclose by simp
   also
   have " ... = Hv(G,x,\<lambda>z\<in>domain(x). val(G,z))"
     using aux_def_val val_def by simp
   finally
   show ?thesis
     using Hv_def by simp
 qed
 
 lemma val_mono : "x\<subseteq>y \<Longrightarrow> val(G,x) \<subseteq> val(G,y)"
   by (subst (1 2) def_val, force)
 
 text\<open>Check-names are the canonical names for elements of the
 ground model. Here we show that this is the case.\<close>
 
-lemma val_check : "\<one> \<in> G \<Longrightarrow>  \<one> \<in> P \<Longrightarrow> val(G,check(y))  = y"
+lemma val_check : "\<one> \<in> G \<Longrightarrow>  \<one> \<in> \<bbbP> \<Longrightarrow> val(G,check(y))  = y"
 proof (induct rule:eps_induct)
   case (1 y)
   then show ?case
   proof -
     have "check(y) = { \<langle>check(w), \<one>\<rangle> . w \<in> y}"  (is "_ = ?C")
       using def_check .
     then
     have "val(G,check(y)) = val(G, {\<langle>check(w), \<one>\<rangle> . w \<in> y})"
       by simp
     also
     have " ...  = {z . t\<in>domain(?C) , (\<exists>p\<in>G .  \<langle>t, p\<rangle>\<in>?C ) \<and> z=val(G,t) }"
       using def_val by blast
     also
     have " ... =  {z . t\<in>domain(?C) , (\<exists>w\<in>y. t=check(w)) \<and> z=val(G,t) }"
       using 1 by simp
     also
     have " ... = {val(G,check(w)) . w\<in>y }"
       by force
     finally
     show "val(G,check(y)) = y"
       using 1 by simp
   qed
 qed
 
 lemma val_of_name :
-  "val(G,{x\<in>A\<times>P. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>P .  Q(\<langle>t,p\<rangle>) \<and> p \<in> G) \<and> z=val(G,t)}"
+  "val(G,{x\<in>A\<times>\<bbbP>. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>\<bbbP> .  Q(\<langle>t,p\<rangle>) \<and> p \<in> G) \<and> z=val(G,t)}"
 proof -
   let
-    ?n="{x\<in>A\<times>P. Q(x)}" and
+    ?n="{x\<in>A\<times>\<bbbP>. Q(x)}" and
     ?r="\<lambda>\<tau> . edrel(eclose({\<tau>}))"
   let
     ?f="\<lambda>z\<in>?r(?n)-``{?n}. val(G,z)"
   have
     wfR : "wf(?r(\<tau>))" for \<tau>
     by (simp add: wf_edrel)
   have "domain(?n) \<subseteq> A" by auto
   { fix t
-    assume H:"t \<in> domain({x \<in> A \<times> P . Q(x)})"
+    assume H:"t \<in> domain({x \<in> A \<times> \<bbbP> . Q(x)})"
     then have "?f ` t = (if t \<in> ?r(?n)-``{?n} then val(G,t) else 0)"
       by simp
     moreover have "... = val(G,t)"
       using dom_under_edrel_eclose H if_P by auto
   }
   then
-  have Eq1: "t \<in> domain({x \<in> A \<times> P . Q(x)}) \<Longrightarrow> val(G,t) = ?f` t"  for t
+  have Eq1: "t \<in> domain({x \<in> A \<times> \<bbbP> . Q(x)}) \<Longrightarrow> val(G,t) = ?f` t"  for t
     by simp
   have "val(G,?n) = {z . t\<in>domain(?n), (\<exists>p \<in> G . \<langle>t,p\<rangle> \<in> ?n) \<and> z=val(G,t)}"
     by (subst def_val,simp)
   also
-  have "... = {z . t\<in>domain(?n), (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=?f`t}"
+  have "... = {z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=?f`t}"
     unfolding Hv_def
     by (auto simp add:Eq1)
   also
-  have "... = {z . t\<in>domain(?n), (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)}"
+  have "... = {z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)}"
     by (simp)
   also
-  have "... = { z . t\<in>domain(?n), (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
+  have "... = { z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
   proof -
     have "domain(?n) \<subseteq> ?r(?n)-``{?n}"
       using dom_under_edrel_eclose by simp
     then
     have "\<forall>t\<in>domain(?n). (if t\<in>?r(?n)-``{?n} then val(G,t) else 0) = val(G,t)"
       by auto
     then
-    show "{ z . t\<in>domain(?n), (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)} =
-          { z . t\<in>domain(?n), (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
+    show "{ z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=(if t\<in>?r(?n)-``{?n} then val(G,t) else 0)} =
+          { z . t\<in>domain(?n), (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
       by auto
   qed
   also
-  have " ... = { z . t\<in>A, (\<exists>p\<in>P . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
+  have " ... = { z . t\<in>A, (\<exists>p\<in>\<bbbP> . \<langle>t,p\<rangle>\<in>?n \<and> p\<in>G) \<and> z=val(G,t)}"
     by force
   finally
-  show " val(G,?n)  = { z . t\<in>A, (\<exists>p\<in>P . Q(\<langle>t,p\<rangle>) \<and> p\<in>G) \<and> z=val(G,t)}"
+  show " val(G,?n)  = { z . t\<in>A, (\<exists>p\<in>\<bbbP> . Q(\<langle>t,p\<rangle>) \<and> p\<in>G) \<and> z=val(G,t)}"
     by auto
 qed
 
 lemma val_of_name_alt :
-  "val(G,{x\<in>A\<times>P. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>P\<inter>G .  Q(\<langle>t,p\<rangle>)) \<and> z=val(G,t) }"
+  "val(G,{x\<in>A\<times>\<bbbP>. Q(x)}) = {z . t\<in>A , (\<exists>p\<in>\<bbbP>\<inter>G .  Q(\<langle>t,p\<rangle>)) \<and> z=val(G,t) }"
   using val_of_name by force
 
 lemma val_only_names: "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t\<in>domain(\<tau>). \<exists>p\<in>F. x=\<langle>t,p\<rangle>})"
   (is "_ = val(F,?name)")
 proof -
   have "val(F,?name) = {z . t\<in>domain(?name), (\<exists>p\<in>F. \<langle>t, p\<rangle> \<in> ?name) \<and> z=val(F, t)}"
     using def_val by blast
   also
   have " ... = {val(F, t). t\<in>{y\<in>domain(\<tau>). \<exists>p\<in>F. \<langle>y, p\<rangle> \<in> \<tau> }}"
     by blast
   also
   have " ... = {z . t\<in>domain(\<tau>), (\<exists>p\<in>F. \<langle>t, p\<rangle> \<in> \<tau>) \<and> z=val(F, t)}"
     by blast
   also
   have " ... = val(F, \<tau>)"
     using def_val[symmetric] by blast
   finally
   show ?thesis ..
 qed
 
 lemma val_only_pairs: "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})"
 proof
   have "val(F,\<tau>) = val(F,{x\<in>\<tau>. \<exists>t\<in>domain(\<tau>). \<exists>p\<in>F. x=\<langle>t,p\<rangle>})" (is "_ = val(F,?name)")
     using val_only_names .
   also
   have "... \<subseteq> val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})"
     using val_mono[of ?name "{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}"] by auto
   finally
   show "val(F,\<tau>) \<subseteq> val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>})" by simp
 next
   show "val(F,{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}) \<subseteq> val(F,\<tau>)"
     using val_mono[of "{x\<in>\<tau>. \<exists>t p. x=\<langle>t,p\<rangle>}"] by auto
 qed
 
 lemma val_subset_domain_times_range: "val(F,\<tau>) \<subseteq> val(F,domain(\<tau>)\<times>range(\<tau>))"
   using val_only_pairs[THEN equalityD1]
     val_mono[of "{x \<in> \<tau> . \<exists>t p. x = \<langle>t, p\<rangle>}" "domain(\<tau>)\<times>range(\<tau>)"] by blast
 
 lemma val_of_elem: "\<langle>\<theta>,p\<rangle> \<in> \<pi> \<Longrightarrow> p\<in>G \<Longrightarrow> val(G,\<theta>) \<in> val(G,\<pi>)"
 proof -
   assume "\<langle>\<theta>,p\<rangle> \<in> \<pi>"
   then
   have "\<theta>\<in>domain(\<pi>)"
     by auto
   assume "p\<in>G"
   with \<open>\<theta>\<in>domain(\<pi>)\<close> \<open>\<langle>\<theta>,p\<rangle> \<in> \<pi>\<close>
   have "val(G,\<theta>) \<in> {z . t\<in>domain(\<pi>) , (\<exists>p\<in>G .  \<langle>t, p\<rangle>\<in>\<pi>) \<and> z=val(G,t) }"
     by auto
   then
   show ?thesis
     by (subst def_val)
 qed
 
 lemma elem_of_val: "x\<in>val(G,\<pi>) \<Longrightarrow> \<exists>\<theta>\<in>domain(\<pi>). val(G,\<theta>) = x"
   by (subst (asm) def_val,auto)
 
 lemma elem_of_val_pair: "x\<in>val(G,\<pi>) \<Longrightarrow> \<exists>\<theta>. \<exists>p\<in>G.  \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x"
   by (subst (asm) def_val,auto)
 
 lemma elem_of_val_pair':
   assumes "\<pi>\<in>M" "x\<in>val(G,\<pi>)"
   shows "\<exists>\<theta>\<in>M. \<exists>p\<in>G.  \<langle>\<theta>,p\<rangle>\<in>\<pi> \<and> val(G,\<theta>) = x"
 proof -
   from assms
   obtain \<theta> p where "p\<in>G" "\<langle>\<theta>,p\<rangle>\<in>\<pi>" "val(G,\<theta>) = x"
     using elem_of_val_pair by blast
   moreover from this \<open>\<pi>\<in>M\<close>
   have "\<theta>\<in>M"
     using pair_in_M_iff[THEN iffD1, THEN conjunct1, simplified]
       transitivity by blast
   ultimately
   show ?thesis
     by blast
 qed
 
 lemma GenExtD: "x \<in> M[G] \<Longrightarrow> \<exists>\<tau>\<in>M. x = val(G,\<tau>)"
   by (simp add:GenExt_def)
 
 lemma GenExtI: "x \<in> M \<Longrightarrow> val(G,x) \<in> M[G]"
   by (auto simp add: GenExt_def)
 
 lemma Transset_MG : "Transset(M[G])"
 proof -
   { fix vc y
     assume "vc \<in> M[G]" and "y \<in> vc"
     then
     obtain c where "c\<in>M" "val(G,c)\<in>M[G]" "y \<in> val(G,c)"
       using GenExtD by auto
     from \<open>y \<in> val(G,c)\<close>
     obtain \<theta> where "\<theta>\<in>domain(c)" "val(G,\<theta>) = y"
       using elem_of_val by blast
     with trans_M \<open>c\<in>M\<close>
     have "y \<in> M[G]"
       using domain_trans GenExtI by blast
   }
   then
   show ?thesis
     using Transset_def by auto
 qed
 
 lemmas transitivity_MG = Transset_intf[OF Transset_MG]
 
 text\<open>This lemma can be proved before having \<^term>\<open>check_in_M\<close>. At some point Miguel naïvely
 thought that the \<^term>\<open>check_in_M\<close> could be proved using this argument.\<close>
 lemma check_nat_M :
   assumes "n \<in> nat"
   shows "check(n) \<in> M"
   using assms
 proof (induct n)
   case 0
   then
   show ?case
     using zero_in_M by (subst def_check,simp)
 next
   case (succ x)
   have "\<one> \<in> M"
     using one_in_P P_sub_M subsetD by simp
   with \<open>check(x)\<in>M\<close>
   have "\<langle>check(x),\<one>\<rangle> \<in> M"
     using pair_in_M_iff by simp
   then
   have "{\<langle>check(x),\<one>\<rangle>} \<in> M"
     using singleton_closed by simp
   with \<open>check(x)\<in>M\<close>
   have "check(x) \<union> {\<langle>check(x),\<one>\<rangle>} \<in> M"
     using Un_closed by simp
   then
   show ?case
     using \<open>x\<in>nat\<close> def_checkS by simp
 qed
 
 lemma def_PHcheck:
   assumes
     "z\<in>M" "f\<in>M"
   shows
     "Hcheck(z,f) = Replace(z,PHcheck(##M,\<one>,f))"
 proof -
   from assms
   have "\<langle>f`x,\<one>\<rangle> \<in> M" "f`x\<in>M" if "x\<in>z" for x
     using pair_in_M_iff transitivity that apply_closed by simp_all
   then
   have "{y . x \<in> z, y = \<langle>f ` x, \<one>\<rangle>} =  {y . x \<in> z, y = \<langle>f ` x, \<one>\<rangle> \<and> y\<in>M \<and> f`x\<in>M}"
     by simp
   then
   show ?thesis
     using \<open>z\<in>M\<close> \<open>f\<in>M\<close> transitivity
     unfolding Hcheck_def PHcheck_def RepFun_def
     by auto
 qed
 
 (* instance of replacement for hcheck *)
 lemma wfrec_Hcheck :
   assumes "X\<in>M"
   shows "wfrec_replacement(##M,is_Hcheck(##M,\<one>),rcheck(X))"
 proof -
   let ?f="Exists(And(pair_fm(1,0,2),
                is_wfrec_fm(is_Hcheck_fm(8,2,1,0),4,1,0)))"
   have "is_Hcheck(##M,\<one>,a,b,c) \<longleftrightarrow>
         sats(M,is_Hcheck_fm(8,2,1,0),[c,b,a,d,e,y,x,z,\<one>,rcheck(x)])"
     if "a\<in>M" "b\<in>M" "c\<in>M" "d\<in>M" "e\<in>M" "y\<in>M" "x\<in>M" "z\<in>M"
     for a b c d e y x z
     using that \<open>X\<in>M\<close> rcheck_in_M is_Hcheck_iff_sats zero_in_M
     by simp
   then
   have "sats(M,is_wfrec_fm(is_Hcheck_fm(8,2,1,0),4,1,0), [y,x,z,\<one>,rcheck(X)])
         \<longleftrightarrow> is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y)"
     if "x\<in>M" "y\<in>M" "z\<in>M" for x y z
     using that sats_is_wfrec_fm \<open>X\<in>M\<close> rcheck_in_M zero_in_M
     by simp
   moreover from this
   have satsf:"sats(M, ?f, [x,z,\<one>,rcheck(X)]) \<longleftrightarrow>
               (\<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y))"
     if "x\<in>M" "z\<in>M" for x z
     using that \<open>X\<in>M\<close> rcheck_in_M
     by (simp del:pair_abs)
   moreover
   have artyf:"arity(?f) = 4"
     using arity_wfrec_replacement_fm[where p="is_Hcheck_fm(8, 2, 1, 0)" and i=9]
       arity_is_Hcheck_fm ord_simp_union
     by simp
   ultimately
   have "strong_replacement(##M,\<lambda>x z. sats(M,?f,[x,z,\<one>,rcheck(X)]))"
     using ZF_ground_replacements(2) artyf \<open>X\<in>M\<close> rcheck_in_M
     unfolding replacement_assm_def wfrec_Hcheck_fm_def by simp
   then
   have "strong_replacement(##M,\<lambda>x z.
           \<exists>y\<in>M. pair(##M,x,y,z) & is_wfrec(##M, is_Hcheck(##M,\<one>),rcheck(X), x, y))"
     using repl_sats[of M ?f "[\<one>,rcheck(X)]"] satsf by (simp del:pair_abs)
   then
   show ?thesis
     unfolding wfrec_replacement_def by simp
 qed
 
 lemma Hcheck_closed' : "f\<in>M \<Longrightarrow> z\<in>M \<Longrightarrow> {f ` x . x \<in> z} \<in> M"
   using RepFun_closed[OF lam_replacement_imp_strong_replacement]
           lam_replacement_apply apply_closed transM[of _ z]
   by simp
 
 lemma repl_PHcheck :
   assumes "f\<in>M"
   shows "lam_replacement(##M,\<lambda>x. Hcheck(x,f))"
 proof -
   have "Hcheck(x,f) = {f`y . y\<in>x}\<times>{\<one>}" for x
     unfolding Hcheck_def by auto
   moreover
   note assms
   moreover from this
   have 1:"lam_replacement(##M, \<lambda>x . {f`y . y\<in>x}\<times>{\<one>})"
     using lam_replacement_RepFun_apply
       lam_replacement_constant lam_replacement_fst lam_replacement_snd
       singleton_closed cartprod_closed fst_snd_closed Hcheck_closed'
     by (rule_tac lam_replacement_CartProd[THEN [5] lam_replacement_hcomp2],simp_all)
   ultimately
   show ?thesis
     using singleton_closed cartprod_closed Hcheck_closed'
     by(rule_tac lam_replacement_cong[OF 1],auto)
 qed
 
 lemma univ_PHcheck : "\<lbrakk> z\<in>M ; f\<in>M \<rbrakk> \<Longrightarrow> univalent(##M,z,PHcheck(##M,\<one>,f))"
   unfolding univalent_def PHcheck_def
   by simp
 
 lemma PHcheck_closed : "\<lbrakk>z\<in>M ; f\<in>M ; x\<in>z; PHcheck(##M,\<one>,f,x,y) \<rbrakk> \<Longrightarrow> (##M)(y)"
   unfolding PHcheck_def by simp
 
 lemma relation2_Hcheck : "relation2(##M,is_Hcheck(##M,\<one>),Hcheck)"
 proof -
   have "is_Replace(##M,z,PHcheck(##M,\<one>,f),hc) \<longleftrightarrow> hc = Replace(z,PHcheck(##M,\<one>,f))"
     if "z\<in>M" "f\<in>M" "hc\<in>M" for z f hc
     using that Replace_abs[OF _ _ univ_PHcheck] PHcheck_closed[of z f]
     by simp
   with def_PHcheck
   show ?thesis
     unfolding relation2_def is_Hcheck_def Hcheck_def
     by simp
 qed
 
 lemma Hcheck_closed : "\<forall>y\<in>M. \<forall>g\<in>M.  Hcheck(y,g)\<in>M"
 proof -
   have eq:"Hcheck(x,f) = {f`y . y\<in>x}\<times>{\<one>}" for f x
     unfolding Hcheck_def by auto
   then
   have "Hcheck(y,g)\<in>M" if "y\<in>M" "g\<in>M" for y g
     using eq that Hcheck_closed' cartprod_closed singleton_closed
     by simp
   then
   show ?thesis
     by auto
 qed
 
 lemma wf_rcheck : "x\<in>M \<Longrightarrow> wf(rcheck(x))"
   unfolding rcheck_def using wf_trancl[OF wf_Memrel] .
 
 lemma trans_rcheck : "x\<in>M \<Longrightarrow> trans(rcheck(x))"
   unfolding rcheck_def using trans_trancl .
 
 lemma relation_rcheck : "x\<in>M \<Longrightarrow> relation(rcheck(x))"
   unfolding rcheck_def using relation_trancl .
 
 lemma check_in_M : "x\<in>M \<Longrightarrow> check(x) \<in> M"
   using wfrec_Hcheck[of x] check_trancl wf_rcheck trans_rcheck relation_rcheck rcheck_in_M
     Hcheck_closed relation2_Hcheck trans_wfrec_closed[of "rcheck(x)"]
   by simp
 
 (* Internalization and absoluteness of rcheck\<close> *)
 lemma rcheck_abs[Rel] : "\<lbrakk> x\<in>M ; r\<in>M \<rbrakk> \<Longrightarrow> is_rcheck(##M,x,r) \<longleftrightarrow> r = rcheck(x)"
   unfolding rcheck_def is_rcheck_def
   using singleton_closed trancl_closed Memrel_closed eclose_closed zero_in_M
   by simp
 
 lemma check_abs[Rel] :
   assumes "x\<in>M" "z\<in>M"
   shows "is_check(##M,\<one>,x,z) \<longleftrightarrow> z = check(x)"
 proof -
   have "is_check(##M,\<one>,x,z) \<longleftrightarrow> is_wfrec(##M,is_Hcheck(##M,\<one>),rcheck(x),x,z)"
     unfolding is_check_def
     using assms rcheck_abs rcheck_in_M zero_in_M
     unfolding check_trancl is_check_def
     by simp
   then
   show ?thesis
     unfolding check_trancl
     using assms wfrec_Hcheck[of x] wf_rcheck trans_rcheck relation_rcheck rcheck_in_M
       Hcheck_closed relation2_Hcheck trans_wfrec_abs[of "rcheck(x)" x z "is_Hcheck(##M,\<one>)" Hcheck]
     by (simp flip: setclass_iff)
 qed
 
 lemma check_lam_replacement: "lam_replacement(##M,check)"
 proof -
   have "arity(check_fm(2,0,1)) = 3"
     by (simp add:ord_simp_union arity)
   then
   have "Lambda(A, check) \<in> M" if "A\<in>M" for A
     using that check_in_M transitivity[of _ A]
       sats_check_fm check_abs zero_in_M
       check_fm_type ZF_ground_replacements(3)
     by(rule_tac Lambda_in_M [of "check_fm(2,0,1)" "[\<one>]"],simp_all)
   then
   show ?thesis
     using check_in_M lam_replacement_iff_lam_closed[THEN iffD2]
     by simp
 qed
 
-lemma check_replacement: "{check(x). x\<in>P} \<in> M"
+lemma check_replacement: "{check(x). x\<in>\<bbbP>} \<in> M"
   using lam_replacement_imp_strong_replacement_aux[OF check_lam_replacement]
     transitivity check_in_M RepFun_closed
     by simp_all
 
 lemma M_subset_MG : "\<one> \<in> G \<Longrightarrow> M \<subseteq> M[G]"
   using check_in_M GenExtI
   by (intro subsetI, subst val_check [of G,symmetric], auto)
 
 text\<open>The name for the generic filter\<close>
 definition
   G_dot :: "i" where
-  "G_dot \<equiv> {\<langle>check(p),p\<rangle> . p\<in>P}"
+  "G_dot \<equiv> {\<langle>check(p),p\<rangle> . p\<in>\<bbbP>}"
 
 lemma G_dot_in_M : "G_dot \<in> M"
   using lam_replacement_Pair[THEN [5] lam_replacement_hcomp2,OF
     check_lam_replacement lam_replacement_identity]
     check_in_M lam_replacement_imp_strong_replacement_aux
     transitivity check_in_M RepFun_closed pair_in_M_iff
   unfolding G_dot_def
   by simp
 
 lemma zero_in_MG : "0 \<in> M[G]"
 proof -
   have "0 = val(G,0)"
     using zero_in_M elem_of_val by auto
   also
   have "... \<in> M[G]"
     using GenExtI zero_in_M by simp
   finally
   show ?thesis .
 qed
 
 declare check_in_M [simp,intro]
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 context G_generic1
 begin
 
 lemma val_G_dot : "val(G,G_dot) = G"
 proof (intro equalityI subsetI)
   fix x
   assume "x\<in>val(G,G_dot)"
   then obtain \<theta> p where "p\<in>G" "\<langle>\<theta>,p\<rangle> \<in> G_dot" "val(G,\<theta>) = x" "\<theta> = check(p)"
     unfolding G_dot_def using elem_of_val_pair G_dot_in_M
     by force
   then
   show "x \<in> G"
     using G_subset_P one_in_G val_check P_sub_M by auto
 next
   fix p
   assume "p\<in>G"
-  have "\<langle>check(q),q\<rangle> \<in> G_dot" if "q\<in>P" for q
+  have "\<langle>check(q),q\<rangle> \<in> G_dot" if "q\<in>\<bbbP>" for q
     unfolding G_dot_def using that by simp
   with \<open>p\<in>G\<close>
   have "val(G,check(p)) \<in> val(G,G_dot)"
     using val_of_elem G_dot_in_M by blast
   with \<open>p\<in>G\<close>
   show "p \<in> val(G,G_dot)"
     using one_in_G G_subset_P P_sub_M val_check by auto
 qed
 
 lemma G_in_Gen_Ext : "G \<in> M[G]"
   using G_subset_P one_in_G val_G_dot GenExtI[of _ G] G_dot_in_M
   by force
 
 lemmas generic_simps = val_check[OF one_in_G one_in_P]
   M_subset_MG[OF one_in_G, THEN subsetD]
   GenExtI P_in_M
 
 lemmas generic_dests = M_genericD M_generic_compatD
 
 bundle G_generic1_lemmas = generic_simps[simp] generic_dests[dest]
 
 end  \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Not_CH.thy b/thys/Independence_CH/Not_CH.thy
--- a/thys/Independence_CH/Not_CH.thy
+++ b/thys/Independence_CH/Not_CH.thy
@@ -1,593 +1,593 @@
 section\<open>Model of the negation of the Continuum Hypothesis\<close>
 
 theory Not_CH
   imports
     Cardinal_Preservation
 begin
 
 text\<open>We are taking advantage that the poset of finite functions is absolute,
 and thus we work with the unrelativized \<^term>\<open>Fn\<close>. But it would have been more
 appropriate to do the following using the relative \<^term>\<open>Fn_rel\<close>. As it turns
 out, the present theory was developed prior to having \<^term>\<open>Fn\<close> relativized!
 
 We also note that \<^term>\<open>Fn(\<omega>,\<kappa>\<times>\<omega>,2)\<close> is separative, i.e. each \<^term>\<open>X \<in> Fn(\<omega>,\<kappa>\<times>\<omega>,2)\<close>
 has two incompatible extensions; therefore we may recover part of our previous theorem
 @{thm [source] extensions_of_ctms_ZF}. But that result also included the possibility
 of not having $\AC$ in the ground model, which would not be sensible in a context
 where the cardinality of the continuum is under discussion. It is also the case that
 @{thm [source] extensions_of_ctms_ZF} was historically our first formalized result
 (with a different proof) that showed the forcing machinery had all of its elements
 in place.\<close>
 
 abbreviation
   Add_subs :: "i \<Rightarrow> i" where
   "Add_subs(\<kappa>) \<equiv> Fn(\<omega>,\<kappa>\<times>\<omega>,2)"
 
 abbreviation
   Add_le :: "i \<Rightarrow> i" where
   "Add_le(\<kappa>) \<equiv> Fnle(\<omega>,\<kappa> \<times> \<omega>,2)"
 
 lemma (in M_aleph) Aleph_rel2_closed[intro,simp]: "M(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>)"
   using nat_into_Ord by simp
 
 locale M_master = M_cohen + M_library +
   assumes
     UN_lepoll_assumptions:
     "M(A) \<Longrightarrow> M(b) \<Longrightarrow> M(f) \<Longrightarrow> M(A') \<Longrightarrow> separation(M, \<lambda>y. \<exists>x\<in>A'. y = \<langle>x, \<mu> i. x\<in>if_range_F_else_F((`)(A), b, f, i)\<rangle>)"
 
 subsection\<open>Non-absolute concepts between extensions\<close>
 
 sublocale M_master \<subseteq> M_Pi_replacement
   by unfold_locales
 
 locale M_master_sub = M_master + N:M_aleph N for N +
   assumes
     M_imp_N: "M(x) \<Longrightarrow> N(x)" and
     Ord_iff: "Ord(x) \<Longrightarrow> M(x) \<longleftrightarrow> N(x)"
 
 sublocale M_master_sub \<subseteq> M_N_Perm
   using M_imp_N by unfold_locales
 
 context M_master_sub
 begin
 
 lemma cardinal_rel_le_cardinal_rel: "M(X) \<Longrightarrow> |X|\<^bsup>N\<^esup> \<le> |X|\<^bsup>M\<^esup>"
   using M_imp_N N.lepoll_rel_cardinal_rel_le[OF lepoll_rel_transfer Card_rel_is_Ord]
     cardinal_rel_eqpoll_rel[THEN eqpoll_rel_sym, THEN eqpoll_rel_imp_lepoll_rel]
   by simp
 
 lemma Aleph_rel_sub_closed: "Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> N(\<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup>)"
   using Ord_iff[THEN iffD1, OF Card_rel_Aleph_rel[THEN Card_rel_is_Ord]]
   by simp
 
 lemma Card_rel_imp_Card_rel: "Card\<^bsup>N\<^esup>(\<kappa>) \<Longrightarrow> M(\<kappa>) \<Longrightarrow> Card\<^bsup>M\<^esup>(\<kappa>)"
   using N.Card_rel_is_Ord[of \<kappa>] M_imp_N Ord_cardinal_rel_le[of \<kappa>]
     cardinal_rel_le_cardinal_rel[of \<kappa>] le_anti_sym
   unfolding Card_rel_def by auto
 
 lemma csucc_rel_le_csucc_rel:
   assumes "Ord(\<kappa>)" "M(\<kappa>)"
   shows "(\<kappa>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<kappa>\<^sup>+)\<^bsup>N\<^esup>"
 proof -
   note assms
   moreover from this
   have "N(L) \<and> Card\<^bsup>N\<^esup>(L) \<and> \<kappa> < L \<Longrightarrow> M(L) \<and> Card\<^bsup>M\<^esup>(L) \<and> \<kappa> < L"
     (is "?P(L) \<Longrightarrow> ?Q(L)") for L
     using M_imp_N Ord_iff[THEN iffD2, of L] N.Card_rel_is_Ord lt_Ord
       Card_rel_imp_Card_rel by auto
   moreover from assms
   have "N((\<kappa>\<^sup>+)\<^bsup>N\<^esup>)" "Card\<^bsup>N\<^esup>((\<kappa>\<^sup>+)\<^bsup>N\<^esup>)" "\<kappa> < (\<kappa>\<^sup>+)\<^bsup>N\<^esup>"
     using N.lt_csucc_rel[of \<kappa>] N.Card_rel_csucc_rel[of \<kappa>] M_imp_N by simp_all
   ultimately
   show ?thesis
     using M_imp_N Least_antitone[of _ ?P ?Q] unfolding csucc_rel_def by blast
 qed
 
 lemma Aleph_rel_le_Aleph_rel: "Ord(\<alpha>) \<Longrightarrow> M(\<alpha>) \<Longrightarrow> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>\<alpha>\<^esub>\<^bsup>N\<^esup>"
 proof (induct rule:trans_induct3)
   case 0
   then
   show ?case
     using Aleph_rel_zero N.Aleph_rel_zero by simp
 next
   case (succ x)
   then
   have "\<aleph>\<^bsub>x\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>" "Ord(x)" "M(x)" by simp_all
   moreover from this
   have "(\<aleph>\<^bsub>x\<^esub>\<^bsup>M\<^esup>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>M\<^esup>"
     using M_imp_N Ord_iff[THEN iffD2, OF N.Card_rel_is_Ord]
     by (intro csucc_rel_le_mono) simp_all
   moreover from calculation
   have "(\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>M\<^esup> \<le> (\<aleph>\<^bsub>x\<^esub>\<^bsup>N\<^esup>\<^sup>+)\<^bsup>N\<^esup>"
     using M_imp_N N.Card_rel_is_Ord Ord_iff[THEN iffD2, OF N.Card_rel_is_Ord]
     by (intro csucc_rel_le_csucc_rel) auto
   ultimately
   show ?case
     using M_imp_N Aleph_rel_succ N.Aleph_rel_succ csucc_rel_le_csucc_rel
       le_trans by auto
 next
   case (limit x)
   then
   show ?case
     using M_imp_N Aleph_rel_limit N.Aleph_rel_limit
     by simp (blast dest: transM intro!:le_implies_UN_le_UN)
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_master_sub\<close>\<close>
 
 lemmas (in M_ZF2_trans) sep_instances =
   separation_ifrangeF_body separation_ifrangeF_body2 separation_ifrangeF_body3
   separation_ifrangeF_body4 separation_ifrangeF_body5 separation_ifrangeF_body6
   separation_ifrangeF_body7 separation_cardinal_rel_lesspoll_rel
   separation_is_dcwit_body separation_cdltgamma separation_cdeqgamma
 
 lemmas (in M_ZF2_trans) repl_instances = lam_replacement_inj_rel
 
 sublocale M_ZFC2_ground_notCH_trans \<subseteq> M_master "##M"
   using replacement_trans_apply_image
   by unfold_locales (simp_all add:repl_instances sep_instances del:setclass_iff
       add: transrec_replacement_def wfrec_replacement_def)
 
 sublocale M_ZFC2_trans \<subseteq> M_Pi_replacement "##M"
   by unfold_locales
 
 subsection\<open>Cohen forcing is ccc\<close>
 
 context M_ctm2_AC
 begin
 
 lemma ccc_Add_subs_Aleph_2: "ccc\<^bsup>M\<^esup>(Add_subs(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>),Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>))"
 proof -
   interpret M_add_reals "##M" "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>"
     by unfold_locales blast
   show ?thesis
     using ccc_rel_Fn_nat by fast
 qed
 
 end \<comment> \<open>\<^locale>\<open>M_ctm2_AC\<close>\<close>
 
 sublocale G_generic3_AC \<subseteq> M_master_sub "##M" "##(M[G])"
   using M_subset_MG[OF one_in_G] generic Ord_MG_iff
   by unfold_locales auto
 
 lemma (in M_trans) mem_F_bound4:
   fixes F A
   defines "F \<equiv> (`)"
   shows "x\<in>F(A,c) \<Longrightarrow> c \<in> (range(f) \<union> domain(A))"
   using apply_0 unfolding F_def
   by (cases "M(c)", auto simp:F_def)
 
 lemma (in M_trans) mem_F_bound5:
   fixes F A
   defines "F \<equiv> \<lambda>_ x. A`x "
   shows "x\<in>F(A,c) \<Longrightarrow> c \<in> (range(f) \<union> domain(A))"
   using apply_0 unfolding F_def
   by (cases "M(c)", auto simp:F_def drSR_Y_def dC_F_def)
 
 sublocale M_ctm2_AC \<subseteq> M_replacement_lepoll "##M" "(`)"
   using UN_lepoll_assumptions lam_replacement_apply lam_replacement_inj_rel
     mem_F_bound4 apply_0 lam_replacement_minimum
   unfolding lepoll_assumptions_defs
 proof (unfold_locales,
     rule_tac [3] lam_Least_assumption_general[where U=domain, OF _ mem_F_bound4], simp_all)
   fix A i x
   assume "A \<in> M" "x \<in> M" "x \<in> A ` i"
   then
   show "i \<in> M"
     using apply_0[of i A] transM[of _ "domain(A)", simplified]
     by force
 qed
 
 context G_generic3_AC begin
 
 context
   includes G_generic1_lemmas
 begin
 
 lemma G_in_MG: "G \<in> M[G]"
   using G_in_Gen_Ext
   by blast
 
 lemma ccc_preserves_Aleph_succ:
-  assumes "ccc\<^bsup>M\<^esup>(P,leq)" "Ord(z)" "z \<in> M"
+  assumes "ccc\<^bsup>M\<^esup>(\<bbbP>,leq)" "Ord(z)" "z \<in> M"
   shows "Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
 proof (rule ccontr)
   assume "\<not> Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
   moreover
   note \<open>z \<in> M\<close> \<open>Ord(z)\<close>
   moreover from this
   have "Ord(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
     using Card_rel_is_Ord by fastforce
   ultimately
   obtain \<alpha> f where "\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "f \<in> surj\<^bsup>M[G]\<^esup>(\<alpha>, \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
     using ext.lt_surj_rel_empty_imp_Card_rel M_subset_MG[OF one_in_G]
     by force
   moreover from this and \<open>z\<in>M\<close> \<open>Ord(z)\<close>
   have "\<alpha> \<in> M" "f \<in> M[G]"
     using ext.trans_surj_rel_closed
     by (auto dest:transM ext.transM dest!:ltD)
   moreover
-  note \<open>ccc\<^bsup>M\<^esup>(P,leq)\<close> \<open>z\<in>M\<close>
+  note \<open>ccc\<^bsup>M\<^esup>(\<bbbP>,leq)\<close> \<open>z\<in>M\<close>
   ultimately
   obtain F where "F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)" "\<forall>\<beta>\<in>\<alpha>. f`\<beta> \<in> F`\<beta>" "\<forall>\<beta>\<in>\<alpha>. |F`\<beta>|\<^bsup>M\<^esup> \<le> \<omega>"
     "F \<in> M"
     using ccc_fun_approximation_lemma[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" f]
       ext.mem_surj_abs[of f \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"] \<open>Ord(z)\<close>
       surj_is_fun[of f \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"] by auto
   then
   have "\<beta> \<in> \<alpha> \<Longrightarrow> |F`\<beta>|\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>0\<^esub>\<^bsup>M\<^esup>" for \<beta>
     using Aleph_rel_zero by simp
   have "w \<in> F ` x \<Longrightarrow> x \<in> M" for w x
   proof -
     fix w x
     assume "w \<in> F`x"
     then
     have "x \<in> domain(F)"
       using apply_0 by auto
     with \<open>F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close> \<open>\<alpha> \<in> M\<close>
     show "x \<in> M" using domain_of_fun
       by (auto dest:transM)
   qed
   with \<open>\<alpha> \<in> M\<close> \<open>F:\<alpha>\<rightarrow>Pow\<^bsup>M\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close> \<open>F\<in>M\<close>
   interpret M_cardinal_UN_lepoll "##M" "\<lambda>\<beta>. F`\<beta>" \<alpha>
     using UN_lepoll_assumptions lepoll_assumptions
       lam_replacement_apply lam_replacement_inj_rel lam_replacement_minimum
   proof (unfold_locales, auto dest:transM simp del:if_range_F_else_F_def)
     fix f b
     assume "b\<in>M" "f\<in>M"
     with \<open>F\<in>M\<close>
     show "lam_replacement(##M, \<lambda>x. \<mu> i. x \<in> if_range_F_else_F((`)(F), b, f, i))"
       using UN_lepoll_assumptions mem_F_bound5
       by (rule_tac lam_Least_assumption_general[where U="domain", OF _ mem_F_bound5])
         simp_all
   qed
   from \<open>\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>\<close> \<open>\<alpha> \<in> M\<close> \<open>Ord(z)\<close> \<open>z\<in>M\<close>
   have "\<alpha> \<lesssim>\<^bsup>M\<^esup> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using
       cardinal_rel_lt_csucc_rel_iff[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>" \<alpha>]
       le_Card_rel_iff[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>" \<alpha>]
       Aleph_rel_succ[of z] Card_rel_lt_iff[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"]
       lt_Ord[of \<alpha> "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_csucc_rel[of "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_Aleph_rel[THEN Card_rel_is_Ord]
     by simp
   with \<open>\<alpha> < \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>\<close> \<open>\<forall>\<beta>\<in>\<alpha>. |F`\<beta>|\<^bsup>M\<^esup> \<le> \<omega>\<close> \<open>\<alpha> \<in> M\<close> assms
   have "|\<Union>\<beta>\<in>\<alpha>. F`\<beta>|\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using InfCard_rel_Aleph_rel[of z] Aleph_rel_zero
       subset_imp_lepoll_rel[THEN lepoll_rel_imp_cardinal_rel_le,
         of "\<Union>\<beta>\<in>\<alpha>. F`\<beta>" "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"] Aleph_rel_succ
       Aleph_rel_increasing[THEN leI, THEN [2] le_trans, of _ 0 z]
       Ord_0_lt_iff[THEN iffD1, of z]
     by (cases "0<z"; rule_tac lepoll_rel_imp_cardinal_rel_UN_le) (auto, force)
   moreover
   note \<open>z\<in>M\<close> \<open>Ord(z)\<close>
   moreover from \<open>\<forall>\<beta>\<in>\<alpha>. f`\<beta> \<in> F`\<beta>\<close> \<open>f \<in> surj\<^bsup>M[G]\<^esup>(\<alpha>, \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)\<close>
     \<open>\<alpha> \<in> M\<close> \<open>f \<in> M[G]\<close> and this
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<subseteq> (\<Union>\<beta>\<in>\<alpha>. F`\<beta>)"
     using ext.mem_surj_abs by (force simp add:surj_def)
   moreover from \<open>F \<in> M\<close> \<open>\<alpha> \<in> M\<close>
   have "(\<Union>x\<in>\<alpha>. F ` x) \<in> M"
     using j.B_replacement
     by (intro Union_closed[simplified] RepFun_closed[simplified])
       (auto dest:transM)
   ultimately
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
     using subset_imp_le_cardinal_rel[of "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "\<Union>\<beta>\<in>\<alpha>. F`\<beta>"]
       le_trans by auto
   with assms
   show "False"
     using Aleph_rel_increasing not_le_iff_lt[of "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>" "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"]
       Card_rel_Aleph_rel[THEN Card_rel_is_Ord]
     by auto
 qed
 
 end \<comment> \<open>bundle G\_generic1\_lemmas\<close>
 
 end \<comment> \<open>\<^locale>\<open>G_generic3_AC\<close>\<close>
 
 context M_ctm1
 begin
 
 abbreviation
   Add :: "i" where
   "Add \<equiv> Fn(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>, 2)"
 
 end \<comment> \<open>\<^locale>\<open>M_ctm1\<close>\<close>
 
 locale add_generic3 = G_generic3_AC "Fn(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" "Fnle(\<omega>, \<aleph>\<^bsub>2\<^esub>\<^bsup>##M\<^esup> \<times> \<omega>, 2)" 0
 
 sublocale add_generic3 \<subseteq> cohen_data \<omega> "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>" 2 by unfold_locales auto
 
 context add_generic3
 begin
 
 notation Leq (infixl "\<preceq>" 50)
 notation Incompatible (infixl "\<bottom>" 50)
 
 lemma Add_subs_preserves_Aleph_succ: "Ord(z) \<Longrightarrow> z\<in>M \<Longrightarrow> Card\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>)"
   using ccc_preserves_Aleph_succ ccc_Add_subs_Aleph_2
   by auto
 
 lemma Aleph_rel_nats_MG_eq_Aleph_rel_nats_M:
   includes G_generic1_lemmas
   assumes "z \<in> \<omega>"
   shows "\<aleph>\<^bsub>z\<^esub>\<^bsup>M[G]\<^esup> = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
   using assms
 proof (induct)
   case 0
   show ?case
     by(rule trans[OF ext.Aleph_rel_zero Aleph_rel_zero[symmetric]])
 next
   case (succ z)
   then
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<le> \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M[G]\<^esup>"
     using Aleph_rel_le_Aleph_rel nat_into_M by simp
   moreover from \<open>z \<in> \<omega>\<close>
   have "\<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup> \<in> M[G]" "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup> \<in> M[G]"
     using nat_into_M by simp_all
   moreover from this and \<open>\<aleph>\<^bsub>z\<^esub>\<^bsup>M[G]\<^esup> = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>\<close> \<open>z \<in> \<omega>\<close>
   have "\<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M[G]\<^esup> \<le> \<aleph>\<^bsub>succ(z)\<^esub>\<^bsup>M\<^esup>"
     using ext.Aleph_rel_succ nat_into_M
       Add_subs_preserves_Aleph_succ[THEN ext.csucc_rel_le, of z]
       Aleph_rel_increasing[of z "succ(z)"]
     by simp
   ultimately
   show ?case using le_anti_sym by blast
 qed
 
 abbreviation
   f_G :: "i" (\<open>f\<^bsub>G\<^esub>\<close>) where
   "f\<^bsub>G\<^esub> \<equiv> \<Union>G"
 
 abbreviation
   dom_dense :: "i \<Rightarrow> i" where
   "dom_dense(x) \<equiv> {p \<in> Add . x \<in> domain(p) }"
 
 declare (in M_ctm2_AC) Fn_nat_closed[simplified setclass_iff, simp, intro]
 declare (in M_ctm2_AC) Fnle_nat_closed[simp del, rule del,
     simplified setclass_iff, simp, intro]
 declare (in M_ctm2_AC) cexp_rel_closed[simplified setclass_iff, simp, intro]
 declare (in G_generic3_AC) ext.cexp_rel_closed[simplified setclass_iff, simp, intro]
 
 lemma dom_dense_closed[intro,simp]: "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega> \<Longrightarrow> dom_dense(x) \<in> M"
   using separation_in_domain[of x] nat_into_M
   by (rule_tac separation_closed[simplified], blast dest:transM) simp
 
 lemma domain_f_G: assumes "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "y \<in> \<omega>"
   shows "\<langle>x, y\<rangle> \<in> domain(f\<^bsub>G\<^esub>)"
 proof -
   from assms
   have "Add = Fn\<^bsup>M\<^esup>(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2)"
     using Fn_nat_abs by auto
   moreover from this
   have "Fnle(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2) = Fnle\<^bsup>M\<^esup>(\<omega>,\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>,2)"
     unfolding Fnle_rel_def Fnle_def by auto
   moreover from calculation assms
   have "dense(dom_dense(\<langle>x, y\<rangle>))"
     using dense_dom_dense[of "\<langle>x,y\<rangle>" "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>\<times>\<omega>" \<omega>  2] InfCard_rel_nat
     unfolding dense_def by auto
   with assms
   obtain p where "p\<in>dom_dense(\<langle>x, y\<rangle>)" "p\<in>G"
     using M_generic_denseD[of "dom_dense(\<langle>x, y\<rangle>)"]
     by auto
   then
   show "\<langle>x, y\<rangle> \<in> domain(f\<^bsub>G\<^esub>)" by blast
 qed
 
 lemma f_G_funtype:
   includes G_generic1_lemmas
   shows "f\<^bsub>G\<^esub> : \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega> \<rightarrow> 2"
   using generic domain_f_G Pi_iff Un_filter_is_function generic
     subset_trans[OF filter_subset_notion Fn_nat_subset_Pow]
   by force
 
 lemma inj_dense_closed[intro,simp]:
   "w \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<Longrightarrow> x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<Longrightarrow> inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x) \<in> M"
   using transM[OF _ Aleph_rel2_closed] separation_conj separation_bex
     lam_replacement_product
     separation_in lam_replacement_fst lam_replacement_snd lam_replacement_constant
     lam_replacement_hcomp[OF lam_replacement_snd lam_replacement_restrict']
     separation_bex separation_conj
   by simp
 
 lemma Aleph_rel2_new_reals:
   assumes "w \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "x \<in> \<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "w \<noteq> x"
   shows "(\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle>) \<noteq> (\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle>)"
 proof -
   have "0\<in>2" by auto
   with assms
   have "dense(inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x))"
     unfolding dense_def using dense_inj_dense by auto
   with assms
   obtain p where "p\<in>inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x)" "p\<in>G"
     using M_generic_denseD[of "inj_dense(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>,2,w,x)"]
     by blast
   then
   obtain n where "n \<in> \<omega>" "\<langle>\<langle>w, n\<rangle>, 1\<rangle> \<in> p" "\<langle>\<langle>x, n\<rangle>, 0\<rangle> \<in> p"
     by blast
   moreover from this and \<open>p\<in>G\<close>
   have "\<langle>\<langle>w, n\<rangle>, 1\<rangle> \<in> f\<^bsub>G\<^esub>" "\<langle>\<langle>x, n\<rangle>, 0\<rangle> \<in> f\<^bsub>G\<^esub>" by auto
   moreover from calculation
   have "f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle> = 1" "f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle> = 0"
     using f_G_funtype apply_equality
     by auto
   ultimately
   have "(\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>w, n\<rangle>) ` n \<noteq> (\<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub> ` \<langle>x, n\<rangle>) ` n"
     by simp
   then
   show ?thesis by fastforce
 qed
 
 definition
   h_G :: "i" (\<open>h\<^bsub>G\<^esub>\<close>) where
   "h\<^bsub>G\<^esub> \<equiv> \<lambda>\<alpha>\<in>\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>. \<lambda>n\<in>\<omega>. f\<^bsub>G\<^esub>`\<langle>\<alpha>,n\<rangle>"
 
 lemma h_G_in_MG[simp]:
   includes G_generic1_lemmas
   shows "h\<^bsub>G\<^esub> \<in> M[G]"
   using ext.curry_closed[unfolded curry_def] G_in_MG
   unfolding h_G_def
   by simp
 
 lemma h_G_inj_Aleph_rel2_reals: "h\<^bsub>G\<^esub> \<in> inj\<^bsup>M[G]\<^esup>(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>, \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2)"
   using Aleph_rel_sub_closed f_G_funtype G_in_MG Aleph_rel_sub_closed
     ext.curry_rel_exp[unfolded curry_def] ext.curry_closed[unfolded curry_def]
     ext.mem_function_space_rel_abs
   by (intro ext.mem_inj_abs[THEN iffD2],simp_all)
       (auto simp: inj_def h_G_def dest:Aleph_rel2_new_reals)
 
 lemma Aleph2_extension_le_continuum_rel:
   includes G_generic1_lemmas
   shows "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
 proof -
   have "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<lesssim>\<^bsup>M[G]\<^esup> \<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"
     using ext.def_lepoll_rel[of "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>" "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2"]
       h_G_inj_Aleph_rel2_reals Aleph_rel_nats_MG_eq_Aleph_rel_nats_M
     by auto
   moreover from calculation
   have "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<lesssim>\<^bsup>M[G]\<^esup> |\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2|\<^bsup>M[G]\<^esup>"
     using ext.lepoll_rel_imp_lepoll_rel_cardinal_rel by simp
   ultimately
   have "|\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup>|\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
     using ext.lepoll_rel_imp_cardinal_rel_le[of "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup>" "\<omega> \<rightarrow>\<^bsup>M[G]\<^esup> 2",
         OF _ _ ext.function_space_rel_closed]
       ext.Aleph_rel_zero
     unfolding cexp_rel_def by simp
   then
   show "\<aleph>\<^bsub>2\<^esub>\<^bsup>M[G]\<^esup> \<le> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
     using ext.Card_rel_Aleph_rel[of 2, THEN ext.Card_rel_cardinal_rel_eq]
     by simp
 qed
 
 lemma Aleph_rel_lt_continuum_rel: "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> < 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
   using Aleph2_extension_le_continuum_rel
     ext.Aleph_rel_increasing[of 1 2] le_trans by auto
 
 corollary not_CH: "\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> \<noteq> 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>"
   using Aleph_rel_lt_continuum_rel by auto
 
 end \<comment> \<open>\<^locale>\<open>add_generic3\<close>\<close>
 
 subsection\<open>Models of fragments of $\ZFC + \neg \CH$\<close>
 
 definition
   ContHyp :: "o" where
   "ContHyp \<equiv> \<aleph>\<^bsub>1\<^esub> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^esup>"
 
 relativize functional "ContHyp" "ContHyp_rel"
 notation ContHyp_rel (\<open>CH\<^bsup>_\<^esup>\<close>)
 relationalize "ContHyp_rel" "is_ContHyp"
 
 context M_ZF_library
 begin
 
 is_iff_rel for "ContHyp"
   using is_cexp_iff is_Aleph_iff[of 0] is_Aleph_iff[of 1]
   unfolding is_ContHyp_def ContHyp_rel_def
   by (auto simp del:setclass_iff) (rule rexI[of _ _ M, OF _ nonempty], auto)
 
 end \<comment> \<open>\<^locale>\<open>M_ZF_library\<close>\<close>
 
 synthesize "is_ContHyp" from_definition assuming "nonempty"
 arity_theorem for "is_ContHyp_fm"
 
 notation is_ContHyp_fm (\<open>\<cdot>CH\<cdot>\<close>)
 
 theorem ctm_of_not_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
     "\<Phi> \<subseteq> formula" "M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<union> { \<cdot>Replacement(\<phi>)\<cdot> . \<phi> \<in> \<Phi>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof -
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
   interpret M_ZFC3 M
     using M_satT_overhead_imp_M_ZF3 unfolding overhead_notCH_def by force
   from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close> \<open>Transset(M)\<close>
   interpret M_ZF_ground_notCH_trans M
     using M_satT_imp_M_ZF_ground_notCH_trans
     unfolding ZC_def by auto
   from \<open>M \<approx> \<omega>\<close>
   obtain enum where "enum \<in> bij(\<omega>,M)"
     using eqpoll_sym unfolding eqpoll_def by blast
   then
   interpret M_ctm3_AC M enum by unfold_locales
   interpret cohen_data \<omega> "\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup> \<times> \<omega>" 2 by unfold_locales auto
   have "Add \<in> M" "Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>) \<in> M"
     using nat_into_M Aleph_rel_closed M_nat cartprod_closed Fn_nat_closed Fnle_nat_closed
     by simp_all
   then
   interpret forcing_data1 "Add" "Add_le(\<aleph>\<^bsub>2\<^esub>\<^bsup>M\<^esup>)" 0 M enum
     by unfold_locales simp_all
   obtain G where "M_generic(G)"
     using generic_filter_existence[OF one_in_P]
     by auto
   moreover from this
   interpret add_generic3 M enum G by unfold_locales
   have "\<not> (\<aleph>\<^bsub>1\<^esub>\<^bsup>M[G]\<^esup> = 2\<^bsup>\<up>\<aleph>\<^bsub>0\<^esub>\<^bsup>M[G]\<^esup>,M[G]\<^esup>)"
     using not_CH .
   then
   have "M[G], [] \<Turnstile> \<cdot>\<not>\<cdot>CH\<cdot>\<cdot>"
     using ext.is_ContHyp_iff
     by (simp add:ContHyp_rel_def)
   then
   have "M[G] \<Turnstile> ZC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}"
     using ext.M_satT_ZC by auto
   moreover
   have "Transset(M[G])" using Transset_MG .
   moreover
   have "M \<subseteq> M[G]" using M_subset_MG[OF one_in_G] generic by simp
   moreover
   note \<open>M \<Turnstile> { \<cdot>Replacement(ground_repl_fm(\<phi>))\<cdot> . \<phi> \<in> \<Phi>}\<close> \<open>\<Phi> \<subseteq> formula\<close>
   ultimately
   show ?thesis
     using Ord_MG_iff MG_eqpoll_nat satT_ground_repl_fm_imp_satT_ZF_replacement_fm[of \<Phi>]
     by (rule_tac x="M[G]" in exI, blast)
 qed
 
 lemma ZF_replacement_overhead_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead} \<subseteq> ZFC"
   using overhead_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_overhead_notCH_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH} \<subseteq> ZFC"
   using overhead_notCH_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 lemma ZF_replacement_overhead_CH_sub_ZFC: "{\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH} \<subseteq> ZFC"
   using overhead_CH_type unfolding ZFC_def ZF_def ZF_schemes_def by auto
 
 corollary ctm_ZFC_imp_ctm_not_CH:
   assumes
     "M \<approx> \<omega>" "Transset(M)" "M \<Turnstile> ZFC"
   shows
     "\<exists>N.
       M \<subseteq> N \<and> N \<approx> \<omega> \<and> Transset(N) \<and> N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and>
       (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> (\<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N))"
 proof-
   from assms
   have "\<exists>N.
       M \<subseteq> N \<and>
         N \<approx> \<omega> \<and>
         Transset(N) \<and>
         N \<Turnstile> ZC \<and> N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>} \<and> N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula} \<and> (\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     using ctm_of_not_CH[of M formula] satT_ZFC_imp_satT_ZC[of M]
       satT_mono[OF _ ground_repl_fm_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_overhead_notCH_sub_ZFC, of M]
       satT_mono[OF _ ZF_replacement_fms_sub_ZFC, of M]
     by (simp add: satT_Un_iff)
   then
   obtain N where "N \<Turnstile> ZC" "N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}" "N \<Turnstile> {\<cdot>Replacement(x)\<cdot> . x \<in> formula}"
     "M \<subseteq> N" "N \<approx> \<omega>" "Transset(N)" "(\<forall>\<alpha>. Ord(\<alpha>) \<longrightarrow> \<alpha> \<in> M \<longleftrightarrow> \<alpha> \<in> N)"
     by auto
   moreover from this
   have "N \<Turnstile> ZFC"
     using satT_ZC_ZF_replacement_imp_satT_ZFC
     by auto
   moreover from this and \<open>N \<Turnstile> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}\<close>
   have "N \<Turnstile> ZFC \<union> {\<cdot>\<not>\<cdot>CH\<cdot>\<cdot>}"
     by auto
   ultimately
   show ?thesis by auto
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Powerset_Axiom.thy b/thys/Independence_CH/Powerset_Axiom.thy
--- a/thys/Independence_CH/Powerset_Axiom.thy
+++ b/thys/Independence_CH/Powerset_Axiom.thy
@@ -1,266 +1,266 @@
 section\<open>The Powerset Axiom in $M[G]$\<close>
 theory Powerset_Axiom
   imports Separation_Axiom Pairing_Axiom Union_Axiom
 begin
 
 simple_rename "perm_pow" src "[ss,p,l,o,fs,\<chi>]" tgt "[fs,ss,sp,p,l,o,\<chi>]"
 
 lemma Collect_inter_Transset:
   assumes
     "Transset(M)" "b \<in> M"
   shows
     "{x\<in>b . P(x)} = {x\<in>b . P(x)} \<inter> M"
   using assms unfolding Transset_def
   by (auto)
 
 context G_generic1
 begin
 
 lemma sats_fst_snd_in_M:
   assumes
     "A\<in>M" "B\<in>M" "\<phi> \<in> formula" "p\<in>M" "l\<in>M" "o\<in>M" "\<chi>\<in>M" "arity(\<phi>) \<le> 6"
   shows "{\<langle>s,q\<rangle>\<in>A\<times>B . M, [q,p,l,o,s,\<chi>] \<Turnstile> \<phi>} \<in> M" (is "?\<theta> \<in> M")
 proof -
   let ?\<phi>' = "ren(\<phi>)`6`7`perm_pow_fn"
   from \<open>A\<in>M\<close> \<open>B\<in>M\<close>
   have "A\<times>B \<in> M"
     using cartprod_closed by simp
   from \<open>arity(\<phi>) \<le> 6\<close> \<open>\<phi>\<in> formula\<close>
   have "?\<phi>' \<in> formula" "arity(?\<phi>')\<le>7"
     unfolding perm_pow_fn_def
     using perm_pow_thm  arity_ren ren_tc Nil_type
     by auto
   with \<open>?\<phi>' \<in> formula\<close>
   have arty: "arity(Exists(Exists(And(pair_fm(0,1,2),?\<phi>'))))\<le>5" (is "arity(?\<psi>)\<le>5")
     using ord_simp_union pred_le
     by (auto simp:arity)
   {
     fix sp
     note \<open>A\<times>B \<in> M\<close> \<open>A\<in>M\<close> \<open>B\<in>M\<close>
     moreover
     assume "sp \<in> A\<times>B"
     moreover from calculation
     have "fst(sp) \<in> A" "snd(sp) \<in> B"
       using fst_type snd_type by simp_all
     ultimately
     have "sp \<in> M" "fst(sp) \<in> M" "snd(sp) \<in> M"
       using transitivity
       by simp_all
     note inM = \<open>A\<in>M\<close> \<open>B\<in>M\<close> \<open>p\<in>M\<close> \<open>l\<in>M\<close> \<open>o\<in>M\<close> \<open>\<chi>\<in>M\<close>
       \<open>sp\<in>M\<close> \<open>fst(sp)\<in>M\<close> \<open>snd(sp)\<in>M\<close>
     with arty \<open>sp \<in> M\<close> \<open>?\<phi>' \<in> formula\<close>
     have "(M, [sp,p,l,o,\<chi>]@[p] \<Turnstile> ?\<psi>) \<longleftrightarrow> M,[sp,p,l,o,\<chi>] \<Turnstile> ?\<psi>" (is "(M,?env0@ _\<Turnstile>_) \<longleftrightarrow> _")
       using arity_sats_iff[of ?\<psi> "[p]" M ?env0] by auto
     also from inM \<open>sp \<in> A\<times>B\<close>
     have "... \<longleftrightarrow> sats(M,?\<phi>',[fst(sp),snd(sp),sp,p,l,o,\<chi>])"
       by auto
     also from inM \<open>\<phi> \<in> formula\<close> \<open>arity(\<phi>) \<le> 6\<close>
     have "... \<longleftrightarrow> M, [snd(sp),p,l,o,fst(sp),\<chi>] \<Turnstile> \<phi>"
       (is "sats(_,_,?env1) \<longleftrightarrow> sats(_,_,?env2)")
       using sats_iff_sats_ren[of \<phi> 6 7 ?env2 M ?env1 perm_pow_fn] perm_pow_thm
       unfolding perm_pow_fn_def by simp
     finally
     have "(M,[sp,p,l,o,\<chi>,p] \<Turnstile> ?\<psi>) \<longleftrightarrow> M, [snd(sp),p,l,o,fst(sp),\<chi>] \<Turnstile> \<phi>"
       by simp
   }
   then
   have "?\<theta> = {sp\<in>A\<times>B . sats(M,?\<psi>,[sp,p,l,o,\<chi>,p])}"
     by auto
   with assms \<open>A\<times>B\<in>M\<close>
   show ?thesis
     using separation_ax separation_iff arty leI \<open>?\<phi>' \<in> formula\<close>
     by simp
 qed
 
 declare nat_into_M[rule del, simplified setclass_iff, intro]
 lemmas ssimps = domain_closed cartprod_closed cons_closed
 declare ssimps [simp del, simplified setclass_iff, simp, intro]
 
 lemma Pow_inter_MG:
   assumes "a\<in>M[G]"
   shows "Pow(a) \<inter> M[G] \<in> M[G]"
 proof -
   from assms
   obtain \<tau> where "\<tau> \<in> M" "val(G, \<tau>) = a"
     using GenExtD by auto
-  let ?Q="Pow(domain(\<tau>)\<times>P) \<inter> M"
+  let ?Q="Pow(domain(\<tau>)\<times>\<bbbP>) \<inter> M"
   from \<open>\<tau>\<in>M\<close>
-  have "domain(\<tau>)\<times>P \<in> M" "domain(\<tau>) \<in> M"
+  have "domain(\<tau>)\<times>\<bbbP> \<in> M" "domain(\<tau>) \<in> M"
     by simp_all
   then
   have "?Q \<in> M"
   proof -
-    from power_ax \<open>domain(\<tau>)\<times>P \<in> M\<close>
-    obtain Q where "powerset(##M,domain(\<tau>)\<times>P,Q)" "Q \<in> M"
+    from power_ax \<open>domain(\<tau>)\<times>\<bbbP> \<in> M\<close>
+    obtain Q where "powerset(##M,domain(\<tau>)\<times>\<bbbP>,Q)" "Q \<in> M"
       unfolding power_ax_def by auto
     moreover from calculation
     have "z\<in>Q \<Longrightarrow> z\<in>M" for z
       using transitivity by blast
     ultimately
-    have "Q = {a\<in>Pow(domain(\<tau>)\<times>P) . a\<in>M}"
-      using \<open>domain(\<tau>)\<times>P \<in> M\<close> powerset_abs[of "domain(\<tau>)\<times>P" Q]
+    have "Q = {a\<in>Pow(domain(\<tau>)\<times>\<bbbP>) . a\<in>M}"
+      using \<open>domain(\<tau>)\<times>\<bbbP> \<in> M\<close> powerset_abs[of "domain(\<tau>)\<times>\<bbbP>" Q]
       by (simp flip: setclass_iff)
     also
     have " ... = ?Q"
       by auto
     finally
     show ?thesis
       using \<open>Q\<in>M\<close> by simp
   qed
   let ?\<pi>="?Q\<times>{\<one>}"
   let ?b="val(G,?\<pi>)"
   from \<open>?Q\<in>M\<close>
   have "?\<pi>\<in>M"
     by auto
   then
   have "?b \<in> M[G]"
     using GenExtI by simp
   have "Pow(a) \<inter> M[G] \<subseteq> ?b"
   proof
     fix c
     assume "c \<in> Pow(a) \<inter> M[G]"
     then
     obtain \<chi> where "c\<in>M[G]" "\<chi> \<in> M" "val(G,\<chi>) = c"
       using GenExt_iff by auto
-    let ?\<theta>="{\<langle>\<sigma>,p\<rangle> \<in>domain(\<tau>)\<times>P . p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>] }"
+    let ?\<theta>="{\<langle>\<sigma>,p\<rangle> \<in>domain(\<tau>)\<times>\<bbbP> . p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>] }"
     have "arity(forces(Member(0,1))) = 6"
       using arity_forces_at by auto
     with \<open>domain(\<tau>) \<in> M\<close> \<open>\<chi> \<in> M\<close>
     have "?\<theta> \<in> M"
       using sats_fst_snd_in_M
       by simp
     then
     have "?\<theta> \<in> ?Q" by auto
     then
     have "val(G,?\<theta>) \<in> ?b"
       using one_in_G generic val_of_elem [of ?\<theta> \<one> ?\<pi> G]
       by auto
     have "val(G,?\<theta>) = c"
     proof(intro equalityI subsetI)
       fix x
       assume "x \<in> val(G,?\<theta>)"
       then
       obtain \<sigma> p where 1: "\<langle>\<sigma>,p\<rangle>\<in>?\<theta>" "p\<in>G" "val(G,\<sigma>) =  x"
         using elem_of_val_pair
         by blast
       moreover from \<open>\<langle>\<sigma>,p\<rangle>\<in>?\<theta>\<close> \<open>?\<theta> \<in> M\<close>
       have "\<sigma>\<in>M"
         using name_components_in_M[of _ _ ?\<theta>] by auto
       moreover from 1
-      have "p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>]" "p\<in>P"
+      have "p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>]" "p\<in>\<bbbP>"
         by simp_all
       moreover
       note \<open>val(G,\<chi>) = c\<close> \<open>\<chi> \<in> M\<close>
       ultimately
       have "M[G], [x, c] \<Turnstile> \<cdot>0 \<in> 1\<cdot>"
         using generic definition_of_forcing[where \<phi>="\<cdot>0 \<in> 1\<cdot>"] ord_simp_union
         by auto
       moreover from \<open>\<sigma>\<in>M\<close> \<open>\<chi>\<in>M\<close>
       have "x\<in>M[G]"
         using \<open>val(G,\<sigma>) = x\<close> GenExtI by blast
       ultimately
       show "x\<in>c"
         using \<open>c\<in>M[G]\<close> by simp
     next
       fix x
       assume "x \<in> c"
       with \<open>c \<in> Pow(a) \<inter> M[G]\<close>
       have "x \<in> a" "c\<in>M[G]" "x\<in>M[G]"
         using transitivity_MG by auto
       with \<open>val(G, \<tau>) = a\<close>
       obtain \<sigma> where "\<sigma>\<in>domain(\<tau>)" "val(G,\<sigma>) = x"
         using elem_of_val by blast
       moreover
       note \<open>x\<in>c\<close> \<open>val(G,\<chi>) = c\<close> \<open>c\<in>M[G]\<close> \<open>x\<in>M[G]\<close>
       moreover from calculation
       have "val(G,\<sigma>) \<in> val(G,\<chi>)"
         by simp
       moreover from calculation
       have "M[G], [x, c] \<Turnstile> \<cdot>0 \<in> 1\<cdot>"
         by simp
       moreover
       have "\<sigma>\<in>M"
       proof -
         from \<open>\<sigma>\<in>domain(\<tau>)\<close>
         obtain p where "\<langle>\<sigma>,p\<rangle> \<in> \<tau>"
           by auto
         with \<open>\<tau>\<in>M\<close>
         show ?thesis
           using name_components_in_M by blast
       qed
       moreover
       note \<open>\<chi> \<in> M\<close>
       ultimately
       obtain p where "p\<in>G" "p \<tturnstile> \<cdot>0 \<in> 1\<cdot> [\<sigma>,\<chi>]"
         using generic truth_lemma[of "\<cdot>0 \<in> 1\<cdot>" "[\<sigma>,\<chi>]" ] ord_simp_union
         by auto
       moreover from \<open>p\<in>G\<close>
-      have "p\<in>P"
+      have "p\<in>\<bbbP>"
         using generic by blast
       ultimately
       have "\<langle>\<sigma>,p\<rangle>\<in>?\<theta>"
         using \<open>\<sigma>\<in>domain(\<tau>)\<close> by simp
       with \<open>val(G,\<sigma>) =  x\<close> \<open>p\<in>G\<close>
       show "x\<in>val(G,?\<theta>)"
         using val_of_elem [of _ _ "?\<theta>" G] by auto
     qed
     with \<open>val(G,?\<theta>) \<in> ?b\<close>
     show "c\<in>?b"
       by simp
   qed
   then
   have "Pow(a) \<inter> M[G] = {x\<in>?b . x\<subseteq>a \<and> x\<in>M[G]}"
     by auto
   also from \<open>a\<in>M[G]\<close>
   have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> ) \<and> x\<in>M[G]}"
     using Transset_MG by force
   also
   have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> )} \<inter> M[G]"
     by auto
   also from \<open>?b\<in>M[G]\<close>
   have " ... = {x\<in>?b . ( M[G], [x,a] \<Turnstile> \<cdot>0 \<subseteq> 1\<cdot> )}"
     using Collect_inter_Transset Transset_MG
     by simp
   also from \<open>?b\<in>M[G]\<close> \<open>a\<in>M[G]\<close>
   have " ... \<in> M[G]"
     using Collect_sats_in_MG GenExtI ord_simp_union by (simp add:arity)
   finally
   show ?thesis .
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 sublocale G_generic1 \<subseteq> ext: M_trivial "##M[G]"
   using generic Union_MG pairing_in_MG zero_in_MG transitivity_MG
   unfolding M_trivial_def M_trans_def M_trivial_axioms_def
   by (simp; blast)
 
 context G_generic1 begin
 
 theorem power_in_MG : "power_ax(##(M[G]))"
   unfolding power_ax_def
 proof (intro rallI, simp only:setclass_iff rex_setclass_is_bex)
   fix a
   text\<open>After simplification, we have to show that for every
   \<^term>\<open>a\<in>M[G]\<close> there exists some \<^term>\<open>x\<in>M[G]\<close> satisfying
   \<^term>\<open>powerset(##M[G],a,x)\<close>\<close>
   assume "a \<in> M[G]"
   have "{x\<in>Pow(a) . x \<in> M[G]} = Pow(a) \<inter> M[G]"
     by auto
   also from \<open>a\<in>M[G]\<close>
   have " ... \<in> M[G]"
     using Pow_inter_MG by simp
   finally
   have "{x\<in>Pow(a) . x \<in> M[G]} \<in> M[G]" .
   moreover from \<open>a\<in>M[G]\<close> this
   have "powerset(##M[G], a, {x\<in>Pow(a) . x \<in> M[G]})"
     using ext.powerset_abs
     by simp
   ultimately
   show "\<exists>x\<in>M[G] . powerset(##M[G], a, x)"
     by auto
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Proper_Extension.thy b/thys/Independence_CH/Proper_Extension.thy
--- a/thys/Independence_CH/Proper_Extension.thy
+++ b/thys/Independence_CH/Proper_Extension.thy
@@ -1,84 +1,84 @@
 section\<open>Separative notions and proper extensions\<close>
 theory Proper_Extension
   imports
     Names
 
 begin
 
 text\<open>The key ingredient to obtain a proper extension is to have
 a \<^emph>\<open>separative preorder\<close>:\<close>
 
 locale separative_notion = forcing_notion +
-  assumes separative: "p\<in>P \<Longrightarrow> \<exists>q\<in>P. \<exists>r\<in>P. q \<preceq> p \<and> r \<preceq> p \<and> q \<bottom> r"
+  assumes separative: "p\<in>\<bbbP> \<Longrightarrow> \<exists>q\<in>\<bbbP>. \<exists>r\<in>\<bbbP>. q \<preceq> p \<and> r \<preceq> p \<and> q \<bottom> r"
 begin
 
 text\<open>For separative preorders, the complement of every filter is
 dense. Hence an $M$-generic filter cannot belong to the ground model.\<close>
 
 lemma filter_complement_dense:
   assumes "filter(G)"
-  shows "dense(P - G)"
+  shows "dense(\<bbbP> - G)"
 proof
   fix p
-  assume "p\<in>P"
-  show "\<exists>d\<in>P - G. d \<preceq> p"
+  assume "p\<in>\<bbbP>"
+  show "\<exists>d\<in>\<bbbP> - G. d \<preceq> p"
   proof (cases "p\<in>G")
     case True
-    note \<open>p\<in>P\<close> assms
+    note \<open>p\<in>\<bbbP>\<close> assms
     moreover
-    obtain q r where "q \<preceq> p" "r \<preceq> p" "q \<bottom> r" "q\<in>P" "r\<in>P"
-      using separative[OF \<open>p\<in>P\<close>]
+    obtain q r where "q \<preceq> p" "r \<preceq> p" "q \<bottom> r" "q\<in>\<bbbP>" "r\<in>\<bbbP>"
+      using separative[OF \<open>p\<in>\<bbbP>\<close>]
       by force
     with \<open>filter(G)\<close>
-    obtain s where "s \<preceq> p" "s \<notin> G" "s \<in> P"
+    obtain s where "s \<preceq> p" "s \<notin> G" "s \<in> \<bbbP>"
       using filter_imp_compat[of G q r]
       by auto
     then
     show ?thesis
       by blast
   next
     case False
-    with \<open>p\<in>P\<close>
+    with \<open>p\<in>\<bbbP>\<close>
     show ?thesis
       using refl_leq unfolding Diff_def by auto
   qed
 qed
 
 end \<comment> \<open>\<^locale>\<open>separative_notion\<close>\<close>
 
 locale ctm_separative = forcing_data1 + separative_notion
 begin
 
 context
   fixes G
   assumes generic: "M_generic(G)"
 begin
 
-interpretation G_generic1 P leq \<one> M enum G
+interpretation G_generic1 \<bbbP> leq \<one> M enum G
   by unfold_locales (simp add:generic)
 
 lemma generic_not_in_M:
   shows "G \<notin> M"
 proof
   assume "G\<in>M"
   then
-  have "P - G \<in> M"
+  have "\<bbbP> - G \<in> M"
     using Diff_closed by simp
   moreover
-  have "\<not>(\<exists>q\<in>G. q \<in> P - G)" "(P - G) \<subseteq> P"
+  have "\<not>(\<exists>q\<in>G. q \<in> \<bbbP> - G)" "(\<bbbP> - G) \<subseteq> \<bbbP>"
     unfolding Diff_def by auto
   moreover
   note generic
   ultimately
   show "False"
-    using filter_complement_dense[of G] M_generic_denseD[of "P-G"]
+    using filter_complement_dense[of G] M_generic_denseD[of "\<bbbP>-G"]
     by auto
 qed
 
 theorem proper_extension: "M \<noteq> M[G]"
   using generic G_in_Gen_Ext one_in_G generic_not_in_M
   by force
 end
 end \<comment> \<open>\<^locale>\<open>ctm_separative\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Replacement_Axiom.thy b/thys/Independence_CH/Replacement_Axiom.thy
--- a/thys/Independence_CH/Replacement_Axiom.thy
+++ b/thys/Independence_CH/Replacement_Axiom.thy
@@ -1,306 +1,306 @@
 section\<open>The Axiom of Replacement in $M[G]$\<close>
 theory Replacement_Axiom
   imports
     Separation_Axiom
 begin
 
 context forcing_data1
 begin
 
 bundle sharp_simps1 = snd_abs[simp] fst_abs[simp] fst_closed[simp del, simplified, simp]
   snd_closed[simp del, simplified, simp] M_inhabited[simplified, simp]
   pair_in_M_iff[simp del, simplified, simp]
 
 lemma sats_body_ground_repl_fm:
   includes sharp_simps1
   assumes
-    "\<exists>t p. x=\<langle>t,p\<rangle>" "[x,\<alpha>,m,P,leq,\<one>] @ nenv \<in>list(M)"
+    "\<exists>t p. x=\<langle>t,p\<rangle>" "[x,\<alpha>,m,\<bbbP>,leq,\<one>] @ nenv \<in>list(M)"
     "\<phi>\<in>formula"
   shows
     "(\<exists>\<tau>\<in>M. \<exists>V\<in>M. is_Vset(\<lambda>a. (##M)(a),\<alpha>,V) \<and> \<tau> \<in> V \<and> (snd(x) \<tturnstile> \<phi> ([fst(x),\<tau>]@nenv)))
-    \<longleftrightarrow> M, [\<alpha>, x, m, P, leq, \<one>] @ nenv \<Turnstile> body_ground_repl_fm(\<phi>)"
+    \<longleftrightarrow> M, [\<alpha>, x, m, \<bbbP>, leq, \<one>] @ nenv \<Turnstile> body_ground_repl_fm(\<phi>)"
   unfolding body_ground_repl_fm_def rename_split_fm_def
   by ((insert assms,rule iff_sats | simp add:nonempty[simplified])+,
       insert sats_incr_bv_iff[where bvs="[_,_,_,_,_,_]", simplified],auto del: iffI)
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 context G_generic1
 begin
 
 lemma Replace_sats_in_MG:
   assumes
     "c\<in>M[G]" "env \<in> list(M[G])"
     "\<phi> \<in> formula" "arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env)"
     "univalent(##M[G], c, \<lambda>x v. (M[G] , [x,v]@env \<Turnstile> \<phi>) )"
     and
     ground_replacement:
-    "\<And>nenv. ground_replacement_assm(M,[P,leq,\<one>] @ nenv, \<phi>)"
+    "\<And>nenv. ground_replacement_assm(M,[\<bbbP>,leq,\<one>] @ nenv, \<phi>)"
   shows
     "{v. x\<in>c, v\<in>M[G] \<and> (M[G] , [x,v]@env \<Turnstile> \<phi>)} \<in> M[G]"
 proof -
   let ?R = "\<lambda> x v . v\<in>M[G] \<and> (M[G] , [x,v]@env \<Turnstile> \<phi>)"
   from \<open>c\<in>M[G]\<close>
   obtain \<pi>' where "val(G, \<pi>') = c" "\<pi>' \<in> M"
     using GenExt_def by auto
   then
-  have "domain(\<pi>')\<times>P\<in>M" (is "?\<pi>\<in>M")
+  have "domain(\<pi>')\<times>\<bbbP>\<in>M" (is "?\<pi>\<in>M")
     using cartprod_closed domain_closed by simp
   from \<open>val(G, \<pi>') = c\<close>
   have "c \<subseteq> val(G,?\<pi>)"
     using def_val[of G ?\<pi>] elem_of_val[of _ G \<pi>'] one_in_G
        domain_of_prod[OF one_in_P, of "domain(\<pi>')"]
     by (force del:M_genericD)
   from \<open>env \<in> _\<close>
   obtain nenv where "nenv\<in>list(M)" "env = map(val(G),nenv)"
     using map_val by auto
   then
   have "length(nenv) = length(env)" by simp
   with \<open>arity(\<phi>) \<le> _\<close>
   have "arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(nenv)" by simp
   define f where "f(\<rho>p) \<equiv> \<mu> \<alpha>. \<alpha>\<in>M \<and> (\<exists>\<tau>\<in>M. \<tau> \<in> Vset(\<alpha>) \<and>
         (snd(\<rho>p) \<tturnstile> \<phi> ([fst(\<rho>p),\<tau>] @ nenv)))" (is "_ \<equiv> \<mu> \<alpha>. ?P(\<rho>p,\<alpha>)") for \<rho>p
   have "f(\<rho>p) = (\<mu> \<alpha>. \<alpha>\<in>M \<and> (\<exists>\<tau>\<in>M. \<exists>V\<in>M. is_Vset(##M,\<alpha>,V) \<and> \<tau>\<in>V \<and>
         (snd(\<rho>p) \<tturnstile> \<phi> ([fst(\<rho>p),\<tau>] @ nenv))))" (is "_ = (\<mu> \<alpha>. \<alpha>\<in>M \<and> ?Q(\<rho>p,\<alpha>))") for \<rho>p
     unfolding f_def using Vset_abs Vset_closed Ord_Least_cong[of "?P(\<rho>p)" "\<lambda> \<alpha>. \<alpha>\<in>M \<and> ?Q(\<rho>p,\<alpha>)"]
     by (simp, simp del:setclass_iff)
   moreover
   note inM = \<open>nenv\<in>list(M)\<close> \<open>?\<pi>\<in>M\<close>
   moreover
   have "f(\<rho>p) \<in> M" "Ord(f(\<rho>p))" for \<rho>p
     unfolding f_def using Least_closed'[of "?P(\<rho>p)"] by simp_all
   ultimately
   have 1:"least(##M,\<lambda>\<alpha>. ?Q(\<rho>p,\<alpha>),f(\<rho>p))" for \<rho>p
     using least_abs'[of "\<lambda>\<alpha>. \<alpha>\<in>M \<and> ?Q(\<rho>p,\<alpha>)" "f(\<rho>p)"] least_conj
     by (simp flip: setclass_iff)
   define QQ where "QQ\<equiv>?Q"
   from 1
   have "least(##M,\<lambda>\<alpha>. QQ(\<rho>p,\<alpha>),f(\<rho>p))" for \<rho>p
     unfolding QQ_def .
-  have body:"(M, [\<rho>p,m,P,leq,\<one>] @ nenv \<Turnstile> ground_repl_fm(\<phi>)) \<longleftrightarrow> least(##M, QQ(\<rho>p), m)"
+  have body:"(M, [\<rho>p,m,\<bbbP>,leq,\<one>] @ nenv \<Turnstile> ground_repl_fm(\<phi>)) \<longleftrightarrow> least(##M, QQ(\<rho>p), m)"
     if "\<rho>p\<in>M" "\<rho>p\<in>?\<pi>" "m\<in>M" for \<rho>p m
   proof -
     note inM that
     moreover from this assms 1
-    have "(M , [\<alpha>,\<rho>p,m,P,leq,\<one>] @ nenv \<Turnstile> body_ground_repl_fm(\<phi>)) \<longleftrightarrow> ?Q(\<rho>p,\<alpha>)" if "\<alpha>\<in>M" for \<alpha>
+    have "(M , [\<alpha>,\<rho>p,m,\<bbbP>,leq,\<one>] @ nenv \<Turnstile> body_ground_repl_fm(\<phi>)) \<longleftrightarrow> ?Q(\<rho>p,\<alpha>)" if "\<alpha>\<in>M" for \<alpha>
       using that sats_body_ground_repl_fm[of \<rho>p \<alpha> m nenv \<phi>]
       by auto
     moreover from calculation
     have body:"\<And>\<alpha>. \<alpha> \<in> M \<Longrightarrow> (\<exists>\<tau>\<in>M. \<exists>V\<in>M. is_Vset(\<lambda>a. a\<in>M, \<alpha>, V) \<and> \<tau> \<in> V \<and>
           (snd(\<rho>p) \<tturnstile> \<phi> ([fst(\<rho>p),\<tau>] @ nenv))) \<longleftrightarrow>
-          M, Cons(\<alpha>, [\<rho>p, m, P, leq, \<one>] @ nenv) \<Turnstile> body_ground_repl_fm(\<phi>)"
+          M, Cons(\<alpha>, [\<rho>p, m, \<bbbP>, leq, \<one>] @ nenv) \<Turnstile> body_ground_repl_fm(\<phi>)"
       by simp
     ultimately
-    show "(M , [\<rho>p,m,P,leq,\<one>] @ nenv \<Turnstile> ground_repl_fm(\<phi>)) \<longleftrightarrow> least(##M, QQ(\<rho>p), m)"
+    show "(M , [\<rho>p,m,\<bbbP>,leq,\<one>] @ nenv \<Turnstile> ground_repl_fm(\<phi>)) \<longleftrightarrow> least(##M, QQ(\<rho>p), m)"
       using sats_least_fm[OF body,of 1] unfolding QQ_def ground_repl_fm_def
       by (simp, simp flip: setclass_iff)
   qed
   then
-  have "univalent(##M, ?\<pi>, \<lambda>\<rho>p m. M , [\<rho>p,m] @ ([P,leq,\<one>] @ nenv) \<Turnstile> ground_repl_fm(\<phi>))"
+  have "univalent(##M, ?\<pi>, \<lambda>\<rho>p m. M , [\<rho>p,m] @ ([\<bbbP>,leq,\<one>] @ nenv) \<Turnstile> ground_repl_fm(\<phi>))"
     unfolding univalent_def by (auto intro:unique_least)
   moreover from \<open>length(_) = _\<close> \<open>env \<in> _\<close>
-  have "length([P,leq,\<one>] @ nenv) = 3 +\<^sub>\<omega> length(env)" by simp
+  have "length([\<bbbP>,leq,\<one>] @ nenv) = 3 +\<^sub>\<omega> length(env)" by simp
   moreover from \<open>arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(nenv)\<close>
     \<open>length(_) = length(_)\<close>[symmetric] \<open>nenv\<in>_\<close> \<open>\<phi>\<in>_\<close>
   have "arity(ground_repl_fm(\<phi>)) \<le> 5 +\<^sub>\<omega> length(env)"
     using arity_ground_repl_fm[of \<phi>] le_trans Un_le by auto
   moreover from \<open>\<phi>\<in>formula\<close>
   have "ground_repl_fm(\<phi>)\<in>formula" by simp
   moreover
   note \<open>length(nenv) = length(env)\<close> inM
   ultimately
   obtain Y where "Y\<in>M"
-    "\<forall>m\<in>M. m \<in> Y \<longleftrightarrow> (\<exists>\<rho>p\<in>M. \<rho>p \<in> ?\<pi> \<and> (M, [\<rho>p,m] @ ([P,leq,\<one>] @ nenv) \<Turnstile> ground_repl_fm(\<phi>)))"
+    "\<forall>m\<in>M. m \<in> Y \<longleftrightarrow> (\<exists>\<rho>p\<in>M. \<rho>p \<in> ?\<pi> \<and> (M, [\<rho>p,m] @ ([\<bbbP>,leq,\<one>] @ nenv) \<Turnstile> ground_repl_fm(\<phi>)))"
     using ground_replacement[of nenv]
     unfolding strong_replacement_def ground_replacement_assm_def replacement_assm_def by auto
   with \<open>least(_,QQ(_),f(_))\<close> \<open>f(_) \<in> M\<close> \<open>?\<pi>\<in>M\<close> body
   have "f(\<rho>p)\<in>Y" if "\<rho>p\<in>?\<pi>" for \<rho>p
     using that transitivity[OF _ \<open>?\<pi>\<in>M\<close>]
     by (clarsimp,rename_tac \<rho> p \<rho>p, rule_tac x="\<langle>\<rho>,p\<rangle>" in bexI, auto)
   from \<open>Y\<in>M\<close>
   have "\<Union> {y\<in>Y. Ord(y)} \<in> M" (is "?sup \<in> M")
     using separation_Ord separation_closed Union_closed by simp
   then
   have "{x\<in>Vset(?sup). x \<in> M} \<times> {\<one>} \<in> M" (is "?big_name \<in> M")
     using Vset_closed cartprod_closed singleton_closed by simp
   then
   have "val(G,?big_name) \<in> M[G]"
     by (blast intro:GenExtI)
   have "{v. x\<in>c, ?R(x,v)} \<subseteq> val(G,?big_name)" (is "?repl\<subseteq>?big")
   proof(intro subsetI)
     fix v
     assume "v\<in>?repl"
     moreover from this
     obtain x where "x\<in>c" "M[G], [x, v] @ env \<Turnstile> \<phi>" "v\<in>M[G]"
       by auto
     moreover
     note \<open>val(G,\<pi>')=c\<close> \<open>\<pi>'\<in>M\<close>
     moreover
     from calculation
     obtain \<rho> p where "\<langle>\<rho>,p\<rangle>\<in>\<pi>'" "val(G,\<rho>) = x" "p\<in>G" "\<rho>\<in>M"
       using elem_of_val_pair' by blast
     moreover from this \<open>v\<in>M[G]\<close>
     obtain \<sigma> where "val(G,\<sigma>) = v" "\<sigma>\<in>M"
       using GenExtD by (force del:M_genericD)
     moreover
     note \<open>\<phi>\<in>_\<close> \<open>nenv\<in>_\<close> \<open>env = _\<close> \<open>arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(env)\<close>
     ultimately
-    obtain q where "q\<in>G" "q \<tturnstile> \<phi> ([\<rho>,\<sigma>]@nenv)" "q\<in>P"
+    obtain q where "q\<in>G" "q \<tturnstile> \<phi> ([\<rho>,\<sigma>]@nenv)" "q\<in>\<bbbP>"
       using truth_lemma[OF \<open>\<phi>\<in>_\<close>,of "[\<rho>,\<sigma>] @ nenv"]
       by auto
     with \<open>\<langle>\<rho>,p\<rangle>\<in>\<pi>'\<close> \<open>\<langle>\<rho>,q\<rangle>\<in>?\<pi> \<Longrightarrow> f(\<langle>\<rho>,q\<rangle>)\<in>Y\<close>
     have "f(\<langle>\<rho>,q\<rangle>)\<in>Y"
       using generic by blast
     let ?\<alpha>="succ(rank(\<sigma>))"
     note \<open>\<sigma>\<in>M\<close>
     moreover from this
     have "?\<alpha> \<in> M" "\<sigma> \<in> Vset(?\<alpha>)"
       using rank_closed cons_closed Vset_Ord_rank_iff
       by (simp_all flip: setclass_iff)
     moreover
     note \<open>q \<tturnstile> \<phi> ([\<rho>,\<sigma>] @ nenv)\<close>
     ultimately
     have "?P(\<langle>\<rho>,q\<rangle>,?\<alpha>)" by (auto simp del: Vset_rank_iff)
     moreover
     have "(\<mu> \<alpha>. ?P(\<langle>\<rho>,q\<rangle>,\<alpha>)) = f(\<langle>\<rho>,q\<rangle>)"
       unfolding f_def by simp
     ultimately
     obtain \<tau> where "\<tau>\<in>M" "\<tau> \<in> Vset(f(\<langle>\<rho>,q\<rangle>))" "q \<tturnstile> \<phi> ([\<rho>,\<tau>] @ nenv)"
       using LeastI[of "\<lambda> \<alpha>. ?P(\<langle>\<rho>,q\<rangle>,\<alpha>)" ?\<alpha>] by auto
     with \<open>q\<in>G\<close> \<open>\<rho>\<in>M\<close> \<open>nenv\<in>_\<close> \<open>arity(\<phi>)\<le> 2 +\<^sub>\<omega> length(nenv)\<close>
     have "M[G], map(val(G),[\<rho>,\<tau>] @ nenv) \<Turnstile> \<phi>"
       using truth_lemma[OF \<open>\<phi>\<in>_\<close>, of "[\<rho>,\<tau>] @ nenv"] by auto
     moreover from \<open>x\<in>c\<close> \<open>c\<in>M[G]\<close>
     have "x\<in>M[G]" using transitivity_MG by simp
     moreover
     note \<open>M[G],[x,v] @ env\<Turnstile> \<phi>\<close> \<open>env = map(val(G),nenv)\<close> \<open>\<tau>\<in>M\<close> \<open>val(G,\<rho>)=x\<close>
       \<open>univalent(##M[G],_,_)\<close> \<open>x\<in>c\<close> \<open>v\<in>M[G]\<close>
     ultimately
     have "v=val(G,\<tau>)"
       using GenExtI[of \<tau> G] unfolding univalent_def by (auto)
     from \<open>\<tau> \<in> Vset(f(\<langle>\<rho>,q\<rangle>))\<close> \<open>Ord(f(_))\<close>  \<open>f(\<langle>\<rho>,q\<rangle>)\<in>Y\<close>
     have "\<tau> \<in> Vset(?sup)"
       using Vset_Ord_rank_iff lt_Union_iff[of _ "rank(\<tau>)"] by auto
     with \<open>\<tau>\<in>M\<close>
     have "val(G,\<tau>) \<in> val(G,?big_name)"
       using domain_of_prod[of \<one> "{\<one>}" "{x\<in>Vset(?sup). x \<in> M}" ] def_val[of G ?big_name]
         one_in_G one_in_P  by (auto simp del: Vset_rank_iff)
     with \<open>v=val(G,\<tau>)\<close>
     show "v \<in> val(G,?big_name)"
       by simp
   qed
   from \<open>?big_name\<in>M\<close>
   have "?repl = {v\<in>?big. \<exists>x\<in>c. M[G], [x,v] @ env \<Turnstile>  \<phi>}" (is "_ = ?rhs")
   proof(intro equalityI subsetI)
     fix v
     assume "v\<in>?repl"
     with \<open>?repl\<subseteq>?big\<close>
     obtain x where "x\<in>c" "M[G], [x, v] @ env \<Turnstile> \<phi>" "v\<in>?big"
       using subsetD by auto
     with \<open>univalent(##M[G],_,_)\<close> \<open>c\<in>M[G]\<close>
     show "v \<in> ?rhs"
       unfolding univalent_def
       using transitivity_MG ReplaceI[of "\<lambda> x v. \<exists>x\<in>c. M[G], [x, v] @ env \<Turnstile> \<phi>"] by blast
   next
     fix v
     assume "v\<in>?rhs"
     then
     obtain x where
       "v\<in>val(G, ?big_name)" "M[G], [x, v] @ env \<Turnstile> \<phi>" "x\<in>c"
       by blast
     moreover from this \<open>c\<in>M[G]\<close>
     have "v\<in>M[G]" "x\<in>M[G]"
       using transitivity_MG GenExtI[OF \<open>?big_name\<in>_\<close>,of G] by auto
     moreover from calculation \<open>univalent(##M[G],_,_)\<close>
     have "?R(x,y) \<Longrightarrow> y = v" for y
       unfolding univalent_def by auto
     ultimately
     show "v\<in>?repl"
       using ReplaceI[of ?R x v c]
       by blast
   qed
   moreover
   let ?\<psi> = "(\<cdot>\<exists>\<cdot>\<cdot>0 \<in> 2 +\<^sub>\<omega> length(env) \<cdot> \<and> \<phi>\<cdot>\<cdot>)"
   from \<open>\<phi>\<in>_\<close>
   have "?\<psi>\<in>formula" "arity(?\<psi>) \<le> 2 +\<^sub>\<omega> length(env)"
     using pred_mono[OF _ \<open>arity(\<phi>)\<le>2+\<^sub>\<omega>length(env)\<close>] lt_trans[OF _ le_refl]
     by (auto simp add:ord_simp_union arity)
   moreover
   from \<open>\<phi>\<in>_\<close> \<open>arity(\<phi>)\<le>2+\<^sub>\<omega>length(env)\<close> \<open>c\<in>M[G]\<close> \<open>env\<in>_\<close>
   have "(\<exists>x\<in>c. M[G], [x,v] @ env \<Turnstile> \<phi>) \<longleftrightarrow> M[G], [v] @ env @ [c] \<Turnstile> ?\<psi>" if "v\<in>M[G]" for v
     using that nth_concat transitivity_MG[OF _ \<open>c\<in>M[G]\<close>] arity_sats_iff[of \<phi> "[c]" _ "[_,v]@env"]
     by auto
   moreover from this
   have "{v\<in>?big. \<exists>x\<in>c. M[G], [x,v] @ env \<Turnstile> \<phi>} = {v\<in>?big. M[G], [v] @ env @ [c] \<Turnstile>  ?\<psi>}"
     using transitivity_MG[OF _ GenExtI, OF _ \<open>?big_name\<in>M\<close>]
     by simp
   moreover from calculation and \<open>env\<in>_\<close> \<open>c\<in>_\<close> \<open>?big\<in>M[G]\<close>
   have "{v\<in>?big. M[G] , [v] @ env @ [c] \<Turnstile> ?\<psi>} \<in> M[G]"
     using Collect_sats_in_MG by auto
   ultimately
   show ?thesis by simp
 qed
 
 theorem strong_replacement_in_MG:
   assumes
     "\<phi>\<in>formula" and "arity(\<phi>) \<le> 2 +\<^sub>\<omega> length(env)" "env \<in> list(M[G])"
     and
     ground_replacement:
-    "\<And>nenv. ground_replacement_assm(M,[P,leq,\<one>] @ nenv, \<phi>)"
+    "\<And>nenv. ground_replacement_assm(M,[\<bbbP>,leq,\<one>] @ nenv, \<phi>)"
   shows
     "strong_replacement(##M[G],\<lambda>x v. M[G],[x,v] @ env \<Turnstile> \<phi>)"
 proof -
   let ?R="\<lambda>x y . M[G], [x, y] @ env \<Turnstile> \<phi>"
   {
     fix A
     let ?Y="{v . x \<in> A, v\<in>M[G] \<and> ?R(x,v)}"
     assume 1: "(##M[G])(A)" "univalent(##M[G], A, ?R)"
     with assms
     have "(##M[G])(?Y)"
       using Replace_sats_in_MG ground_replacement 1
       unfolding ground_replacement_assm_def by auto
     have "b \<in> ?Y \<longleftrightarrow> (\<exists>x[##M[G]]. x \<in> A \<and> ?R(x,b))" if "(##M[G])(b)" for b
     proof(rule)
       from \<open>(##M[G])(A)\<close>
       show "\<exists>x[##M[G]]. x \<in> A \<and> ?R(x,b)" if "b \<in> ?Y"
         using that transitivity_MG by auto
     next
       show "b \<in> ?Y" if "\<exists>x[##M[G]]. x \<in> A \<and> ?R(x,b)"
       proof -
         from \<open>(##M[G])(b)\<close>
         have "b\<in>M[G]" by simp
         with that
         obtain x where "(##M[G])(x)" "x\<in>A" "b\<in>M[G] \<and> ?R(x,b)"
           by blast
         moreover from this 1 \<open>(##M[G])(b)\<close>
         have "x\<in>M[G]" "z\<in>M[G] \<and> ?R(x,z) \<Longrightarrow> b = z" for z
           unfolding univalent_def
           by auto
         ultimately
         show ?thesis
           using ReplaceI[of "\<lambda> x y. y\<in>M[G] \<and> ?R(x,y)"] by blast
       qed
     qed
     then
     have "\<forall>b[##M[G]]. b \<in> ?Y \<longleftrightarrow> (\<exists>x[##M[G]]. x \<in> A \<and> ?R(x,b))"
       by simp
     with \<open>(##M[G])(?Y)\<close>
     have " (\<exists>Y[##M[G]]. \<forall>b[##M[G]]. b \<in> Y \<longleftrightarrow> (\<exists>x[##M[G]]. x \<in> A \<and> ?R(x,b)))"
       by auto
   }
   then show ?thesis unfolding strong_replacement_def
     by simp
 qed
 
 lemma replacement_assm_MG:
   assumes
     ground_replacement:
-    "\<And>nenv. ground_replacement_assm(M,[P,leq,\<one>] @ nenv, \<phi>)"
+    "\<And>nenv. ground_replacement_assm(M,[\<bbbP>,leq,\<one>] @ nenv, \<phi>)"
   shows
     "replacement_assm(M[G],env,\<phi>)"
   using assms strong_replacement_in_MG
   unfolding replacement_assm_def by simp
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Separation_Axiom.thy b/thys/Independence_CH/Separation_Axiom.thy
--- a/thys/Independence_CH/Separation_Axiom.thy
+++ b/thys/Independence_CH/Separation_Axiom.thy
@@ -1,291 +1,291 @@
 section\<open>The Axiom of Separation in $M[G]$\<close>
 theory Separation_Axiom
   imports Forcing_Theorems Separation_Rename
 begin
 
 context G_generic1
 begin
 
 lemma map_val :
   assumes "env\<in>list(M[G])"
   shows "\<exists>nenv\<in>list(M). env = map(val(G),nenv)"
   using assms
 proof(induct env)
   case Nil
   have "map(val(G),Nil) = Nil" by simp
   then show ?case by force
 next
   case (Cons a l)
   then obtain a' l' where
     "l' \<in> list(M)" "l=map(val(G),l')" "a = val(G,a')"
     "Cons(a,l) = map(val(G),Cons(a',l'))" "Cons(a',l') \<in> list(M)"
     using GenExtD
     by force
   then show ?case by force
 qed
 
 lemma Collect_sats_in_MG :
   assumes
     "A\<in>M[G]"
     "\<phi> \<in> formula" "env\<in>list(M[G])" "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)"
   shows
     "{x \<in> A . (M[G], [x] @ env \<Turnstile> \<phi>)} \<in> M[G]"
 proof -
   from \<open>A\<in>M[G]\<close>
   obtain \<pi> where "\<pi> \<in> M" "val(G, \<pi>) = A"
     using GenExt_def by auto
   then
-  have "domain(\<pi>)\<in>M" "domain(\<pi>) \<times> P \<in> M"
-    using cartprod_closed[of _ P,simplified]
+  have "domain(\<pi>)\<in>M" "domain(\<pi>) \<times> \<bbbP> \<in> M"
+    using cartprod_closed[of _ \<bbbP>,simplified]
     by (simp_all flip:setclass_iff)
   let ?\<chi>="\<cdot>\<cdot> 0 \<in> (1 +\<^sub>\<omega> length(env)) \<cdot> \<and> \<phi> \<cdot>"
   let ?new_form="sep_ren(length(env),forces(?\<chi>))"
   let ?\<psi>="(\<cdot>\<exists>(\<cdot>\<exists>\<cdot>\<cdot>\<langle>0,1\<rangle> is 2 \<cdot> \<and> ?new_form \<cdot> \<cdot>)\<cdot>)"
   note phi = \<open>\<phi>\<in>formula\<close> \<open>arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)\<close>
   then
   have "?\<chi>\<in>formula" "forces(?\<chi>) \<in> formula" "arity(\<phi>) \<le> 2+\<^sub>\<omega> length(env)"
     using definability le_trans[OF \<open>arity(\<phi>)\<le>_\<close>] add_le_mono[of 1 2,OF _ le_refl]
     by simp_all
   with \<open>env\<in>_\<close> phi
   have "arity(?\<chi>) \<le> 2+\<^sub>\<omega>length(env)"
     using ord_simp_union leI FOL_arities by simp
   with \<open>env\<in>list(_)\<close> phi
   have "arity(forces(?\<chi>)) \<le> 6 +\<^sub>\<omega> length(env)"
     using  arity_forces_le by simp
   then
   have "arity(forces(?\<chi>)) \<le> 7 +\<^sub>\<omega> length(env)"
     using ord_simp_union arity_forces leI by simp
   with \<open>arity(forces(?\<chi>)) \<le>7 +\<^sub>\<omega> _\<close> \<open>env \<in> _\<close> \<open>\<phi> \<in> formula\<close>
   have "arity(?new_form) \<le> 7 +\<^sub>\<omega> length(env)" "?new_form \<in> formula" "?\<psi>\<in>formula"
     using arity_rensep[OF definability[of "?\<chi>"]]
     by auto
   then
   have "arity(?\<psi>) \<le> 5 +\<^sub>\<omega> length(env)"
     using ord_simp_union arity_forces pred_mono[OF _ pred_mono[OF _ \<open>arity(?new_form) \<le> _\<close>]]
     by (auto simp:arity)
   from \<open>env \<in> _\<close>
   obtain nenv where "nenv\<in>list(M)" "env = map(val(G),nenv)" "length(nenv) = length(env)"
     using map_val by auto
   from phi \<open>nenv\<in>_\<close> \<open>env\<in>_\<close> \<open>\<pi>\<in>M\<close> \<open>\<phi>\<in>_\<close> \<open>length(nenv) = length(env)\<close>
   have "arity(?\<chi>) \<le> length([\<theta>] @ nenv @ [\<pi>])" for \<theta>
     using union_abs2[OF \<open>arity(\<phi>) \<le> 2+\<^sub>\<omega> _\<close>] ord_simp_union FOL_arities
     by simp
-  note in_M = \<open>\<pi>\<in>M\<close> \<open>domain(\<pi>) \<times> P \<in> M\<close>
+  note in_M = \<open>\<pi>\<in>M\<close> \<open>domain(\<pi>) \<times> \<bbbP> \<in> M\<close>
   have Equivalence: "
-       (M, [u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) \<longleftrightarrow>
-         (\<exists>\<theta>\<in>M. \<exists>p\<in>P. u =\<langle>\<theta>,p\<rangle> \<and>
+       (M, [u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) \<longleftrightarrow>
+         (\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u =\<langle>\<theta>,p\<rangle> \<and>
           (\<forall>F. M_generic(F) \<and> p \<in> F \<longrightarrow> M[F],  map(val(F), [\<theta>] @ nenv @[\<pi>]) \<Turnstile>  ?\<chi>))"
-    if "u \<in> domain(\<pi>) \<times> P"
+    if "u \<in> domain(\<pi>) \<times> \<bbbP>"
     for u
   proof -
-    from \<open>u \<in> domain(\<pi>) \<times> P\<close> \<open>domain(\<pi>) \<times> P \<in> M\<close>
+    from \<open>u \<in> domain(\<pi>) \<times> \<bbbP>\<close> \<open>domain(\<pi>) \<times> \<bbbP> \<in> M\<close>
     have "u\<in>M" by (simp add:transitivity)
-    have "(M, [\<theta>,p,u,P,leq,\<one>,\<pi>]@nenv \<Turnstile> ?new_form) \<longleftrightarrow>
+    have "(M, [\<theta>,p,u,\<bbbP>,leq,\<one>,\<pi>]@nenv \<Turnstile> ?new_form) \<longleftrightarrow>
           (\<forall>F. M_generic(F) \<and> p \<in> F \<longrightarrow> (M[F],  map(val(F), [\<theta>] @ nenv@[\<pi>]) \<Turnstile>  ?\<chi>))"
-      if "\<theta>\<in>M" "p\<in>P"
+      if "\<theta>\<in>M" "p\<in>\<bbbP>"
       for \<theta> p
     proof -
-      from \<open>p\<in>P\<close>
+      from \<open>p\<in>\<bbbP>\<close>
       have "p\<in>M" by (simp add: transitivity)
-      let ?env="[p,P,leq,\<one>,\<theta>] @ nenv @ [\<pi>,u]"
-      let ?new_env=" [\<theta>,p,u,P,leq,\<one>,\<pi>] @ nenv"
-      note types = in_M \<open>\<theta> \<in> M\<close> \<open>p\<in>M\<close> \<open>u \<in> domain(\<pi>) \<times> P\<close> \<open>u \<in> M\<close> \<open>nenv\<in>_\<close>
+      let ?env="[p,\<bbbP>,leq,\<one>,\<theta>] @ nenv @ [\<pi>,u]"
+      let ?new_env=" [\<theta>,p,u,\<bbbP>,leq,\<one>,\<pi>] @ nenv"
+      note types = in_M \<open>\<theta> \<in> M\<close> \<open>p\<in>M\<close> \<open>u \<in> domain(\<pi>) \<times> \<bbbP>\<close> \<open>u \<in> M\<close> \<open>nenv\<in>_\<close>
       then
       have tyenv:"?env \<in> list(M)" "?new_env \<in> list(M)"
         by simp_all
       from types
-      have eq_env:"[p, P, leq, \<one>] @ ([\<theta>] @ nenv @ [\<pi>,u]) = 
-                  ([p, P, leq, \<one>] @ ([\<theta>] @ nenv @ [\<pi>])) @ [u]"
+      have eq_env:"[p, \<bbbP>, leq, \<one>] @ ([\<theta>] @ nenv @ [\<pi>,u]) = 
+                  ([p, \<bbbP>, leq, \<one>] @ ([\<theta>] @ nenv @ [\<pi>])) @ [u]"
         using app_assoc by simp
       then
-      have "(M, [\<theta>,p,u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?new_form) \<longleftrightarrow> (M, ?new_env \<Turnstile> ?new_form)"
+      have "(M, [\<theta>,p,u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?new_form) \<longleftrightarrow> (M, ?new_env \<Turnstile> ?new_form)"
         by simp
       from tyenv \<open>length(nenv) = length(env)\<close> \<open>arity(forces(?\<chi>)) \<le> 7 +\<^sub>\<omega> length(env)\<close> \<open>forces(?\<chi>) \<in> formula\<close>
       have "... \<longleftrightarrow> p \<tturnstile> ?\<chi> ([\<theta>] @ nenv @ [\<pi>,u])"
         using sepren_action[of "forces(?\<chi>)"  "nenv",OF _ _ \<open>nenv\<in>list(M)\<close>]
         by simp
       also from types phi \<open>env\<in>_\<close> \<open>length(nenv) = length(env)\<close> \<open>arity(forces(?\<chi>)) \<le> 6 +\<^sub>\<omega> length(env)\<close>
       have "... \<longleftrightarrow> p \<tturnstile> ?\<chi>  ([\<theta>] @ nenv @ [\<pi>])"
         by (subst eq_env,rule_tac arity_sats_iff,auto)
-      also from types phi \<open>p\<in>P\<close> \<open>arity(forces(?\<chi>)) \<le> 6 +\<^sub>\<omega> length(env)\<close> \<open>arity(?\<chi>) \<le> length([\<theta>] @ nenv @ [\<pi>])\<close>
+      also from types phi \<open>p\<in>\<bbbP>\<close> \<open>arity(forces(?\<chi>)) \<le> 6 +\<^sub>\<omega> length(env)\<close> \<open>arity(?\<chi>) \<le> length([\<theta>] @ nenv @ [\<pi>])\<close>
       have " ... \<longleftrightarrow> (\<forall>F . M_generic(F) \<and> p \<in> F \<longrightarrow>
                            M[F],  map(val(F), [\<theta>] @ nenv @ [\<pi>]) \<Turnstile>  ?\<chi>)"
         using definition_of_forcing[where \<phi>="\<cdot>\<cdot> 0 \<in> (1 +\<^sub>\<omega> length(env)) \<cdot> \<and> \<phi> \<cdot>"]
         by auto
       finally
       show ?thesis
         by simp
     qed
-    with in_M \<open>?new_form \<in> formula\<close> \<open>?\<psi>\<in>formula\<close> \<open>nenv \<in> _\<close> \<open>u \<in> domain(\<pi>)\<times>P\<close>
+    with in_M \<open>?new_form \<in> formula\<close> \<open>?\<psi>\<in>formula\<close> \<open>nenv \<in> _\<close> \<open>u \<in> domain(\<pi>)\<times>\<bbbP>\<close>
     show ?thesis
       by (auto simp add: transitivity)
   qed
   moreover from \<open>env = _\<close> \<open>\<pi>\<in>M\<close> \<open>nenv\<in>list(M)\<close>
   have map_nenv:"map(val(G), nenv @ [\<pi>]) = env @ [val(G,\<pi>)]"
     using map_app_distrib append1_eq_iff by auto
   ultimately
-  have aux:"(\<exists>\<theta>\<in>M. \<exists>p\<in>P. u =\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> M[G], [val(G,\<theta>)] @ env @ [val(G,\<pi>)] \<Turnstile> ?\<chi>))"
-    (is "(\<exists>\<theta>\<in>M. \<exists>p\<in>P. _ ( _ \<longrightarrow> M[G] , ?vals(\<theta>) \<Turnstile> _))")
-    if "u \<in> domain(\<pi>) \<times> P" "M, [u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
+  have aux:"(\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u =\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> M[G], [val(G,\<theta>)] @ env @ [val(G,\<pi>)] \<Turnstile> ?\<chi>))"
+    (is "(\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. _ ( _ \<longrightarrow> M[G] , ?vals(\<theta>) \<Turnstile> _))")
+    if "u \<in> domain(\<pi>) \<times> \<bbbP>" "M, [u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
     using Equivalence[THEN iffD1, OF that] generic by force
   moreover
   have "[val(G, \<theta>)] @ env @ [val(G, \<pi>)] \<in> list(M[G])" if "\<theta>\<in>M" for \<theta>
     using \<open>\<pi>\<in>M\<close> \<open>env \<in> list(M[G])\<close> GenExtI that by force
   ultimately
-  have "(\<exists>\<theta>\<in>M. \<exists>p\<in>P. u=\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> val(G,\<theta>)\<in>nth(1 +\<^sub>\<omega> length(env),[val(G, \<theta>)] @ env @ [val(G, \<pi>)])
+  have "(\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u=\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> val(G,\<theta>)\<in>nth(1 +\<^sub>\<omega> length(env),[val(G, \<theta>)] @ env @ [val(G, \<pi>)])
         \<and> (M[G], ?vals(\<theta>) \<Turnstile> \<phi>)))"
-    if "u \<in> domain(\<pi>) \<times> P" "M, [u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
+    if "u \<in> domain(\<pi>) \<times> \<bbbP>" "M, [u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
     using aux[OF that] by simp
   moreover from \<open>env \<in> _\<close> \<open>\<pi>\<in>M\<close>
   have nth:"nth(1 +\<^sub>\<omega> length(env),[val(G, \<theta>)] @ env @ [val(G, \<pi>)]) = val(G,\<pi>)"
     if "\<theta>\<in>M" for \<theta>
     using nth_concat[of "val(G,\<theta>)" "val(G,\<pi>)" "M[G]"] that GenExtI by simp
   ultimately
-  have "(\<exists>\<theta>\<in>M. \<exists>p\<in>P. u=\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> val(G,\<theta>)\<in>val(G,\<pi>) \<and> (M[G],?vals(\<theta>) \<Turnstile>  \<phi>)))"
-    if "u \<in> domain(\<pi>) \<times> P" "M, [u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
+  have "(\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u=\<langle>\<theta>,p\<rangle> \<and> (p\<in>G \<longrightarrow> val(G,\<theta>)\<in>val(G,\<pi>) \<and> (M[G],?vals(\<theta>) \<Turnstile>  \<phi>)))"
+    if "u \<in> domain(\<pi>) \<times> \<bbbP>" "M, [u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>" for u
     using that \<open>\<pi>\<in>M\<close> \<open>env \<in> _\<close> by simp
-  with \<open>domain(\<pi>)\<times>P\<in>M\<close>
-  have "\<forall>u\<in>domain(\<pi>)\<times>P . (M, [u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) \<longrightarrow> (\<exists>\<theta>\<in>M. \<exists>p\<in>P. u =\<langle>\<theta>,p\<rangle> \<and>
+  with \<open>domain(\<pi>)\<times>\<bbbP>\<in>M\<close>
+  have "\<forall>u\<in>domain(\<pi>)\<times>\<bbbP> . (M, [u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) \<longrightarrow> (\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u =\<langle>\<theta>,p\<rangle> \<and>
         (p \<in> G \<longrightarrow> val(G, \<theta>)\<in>val(G, \<pi>) \<and> (M[G],?vals(\<theta>) \<Turnstile>  \<phi>)))"
     by (simp add:transitivity)
   then
-  have "{u\<in>domain(\<pi>)\<times>P . (M,[u,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) } \<subseteq>
-     {u\<in>domain(\<pi>)\<times>P . \<exists>\<theta>\<in>M. \<exists>p\<in>P. u =\<langle>\<theta>,p\<rangle> \<and>
+  have "{u\<in>domain(\<pi>)\<times>\<bbbP> . (M,[u,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>) } \<subseteq>
+     {u\<in>domain(\<pi>)\<times>\<bbbP> . \<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. u =\<langle>\<theta>,p\<rangle> \<and>
        (p \<in> G \<longrightarrow> val(G, \<theta>)\<in>val(G, \<pi>) \<and> (M[G], ?vals(\<theta>) \<Turnstile> \<phi>))}"
     (is "?n\<subseteq>?m")
     by auto
   then
   have first_incl: "val(G,?n) \<subseteq> val(G,?m)"
     using val_mono by simp
   note  \<open>val(G,\<pi>) = A\<close> (* from the assumptions *)
   with \<open>?\<psi>\<in>formula\<close>  \<open>arity(?\<psi>) \<le> _\<close> in_M \<open>nenv \<in> _\<close> \<open>env \<in> _\<close> \<open>length(nenv) = _\<close>
   have "?n\<in>M"
     using separation_ax leI separation_iff by auto
   from generic
-  have "filter(G)" "G\<subseteq>P"
+  have "filter(G)" "G\<subseteq>\<bbbP>"
     by auto
   from \<open>val(G,\<pi>) = A\<close>
   have "val(G,?m) =
-               {z . t\<in>domain(\<pi>) , (\<exists>q\<in>P .
-                    (\<exists>\<theta>\<in>M. \<exists>p\<in>P. \<langle>t,q\<rangle> = \<langle>\<theta>, p\<rangle> \<and>
+               {z . t\<in>domain(\<pi>) , (\<exists>q\<in>\<bbbP> .
+                    (\<exists>\<theta>\<in>M. \<exists>p\<in>\<bbbP>. \<langle>t,q\<rangle> = \<langle>\<theta>, p\<rangle> \<and>
             (p \<in> G \<longrightarrow> val(G, \<theta>) \<in> A \<and> (M[G],  [val(G, \<theta>)] @ env @ [A] \<Turnstile>  \<phi>)) \<and> q \<in> G)) \<and>
            z=val(G,t)}"
     using val_of_name by auto
   also
-  have "... =  {z . t\<in>domain(\<pi>) , (\<exists>q\<in>P.
+  have "... =  {z . t\<in>domain(\<pi>) , (\<exists>q\<in>\<bbbP>.
                    val(G, t) \<in> A \<and> (M[G],  [val(G, t)] @ env @ [A] \<Turnstile>  \<phi>) \<and> q \<in> G) \<and> z=val(G,t)}"
     using \<open>domain(\<pi>)\<in>M\<close> by (auto simp add:transitivity)
   also
-  have "... =  {x\<in>A . \<exists>q\<in>P. x \<in> A \<and> (M[G],  [x] @ env @ [A] \<Turnstile>  \<phi>) \<and> q \<in> G}"
+  have "... =  {x\<in>A . \<exists>q\<in>\<bbbP>. x \<in> A \<and> (M[G],  [x] @ env @ [A] \<Turnstile>  \<phi>) \<and> q \<in> G}"
   proof(intro equalityI, auto)
     (* Now we show the other inclusion:
-      {x .. x \<in> A , \<exists>q\<in>P. x \<in> A \<and> (M[G],  [x, w, c] \<Turnstile>  \<phi>) \<and> q \<in> G}
+      {x .. x \<in> A , \<exists>q\<in>\<bbbP>. x \<in> A \<and> (M[G],  [x, w, c] \<Turnstile>  \<phi>) \<and> q \<in> G}
       \<subseteq>
-      {val(G,t)..t\<in>domain(\<pi>),\<exists>q\<in>P.val(G,t)\<in> A\<and>(M[G], [val(G,t),w] \<Turnstile> \<phi>)\<and>q\<in>G}
+      {val(G,t)..t\<in>domain(\<pi>),\<exists>q\<in>\<bbbP>.val(G,t)\<in> A\<and>(M[G], [val(G,t),w] \<Turnstile> \<phi>)\<and>q\<in>G}
     *)
     {
       fix x q
-      assume "M[G], Cons(x, env @ [A]) \<Turnstile> \<phi>" "x\<in>A" "q \<in> P" "q \<in> G"
+      assume "M[G], Cons(x, env @ [A]) \<Turnstile> \<phi>" "x\<in>A" "q \<in> \<bbbP>" "q \<in> G"
       from this \<open>val(G,\<pi>) = A\<close>
-      show "x \<in> {y . x \<in> domain(\<pi>), val(G, x) \<in> A \<and> (M[G], Cons(val(G, x), env @ [A]) \<Turnstile> \<phi>) \<and> (\<exists>q\<in>P. q \<in> G) \<and> y = val(G, x)}"
+      show "x \<in> {y . x \<in> domain(\<pi>), val(G, x) \<in> A \<and> (M[G], Cons(val(G, x), env @ [A]) \<Turnstile> \<phi>) \<and> (\<exists>q\<in>\<bbbP>. q \<in> G) \<and> y = val(G, x)}"
         using elem_of_val by force
     }
   qed
   also
   have " ... = {x \<in> A. (M[G], [x] @ env @ [A] \<Turnstile> \<phi>)}"
-    using \<open>G\<subseteq>P\<close> G_nonempty by force
+    using \<open>G\<subseteq>\<bbbP>\<close> G_nonempty by force
   finally
   have val_m: "val(G,?m) = {x \<in> A. (M[G], [x] @ env @ [A] \<Turnstile> \<phi>)}" by simp
   have "val(G,?m) \<subseteq> val(G,?n)"
   proof
     fix x
     assume "x \<in> val(G,?m)"
     with val_m
     have "x \<in> {x \<in> A. (M[G], [x] @ env @ [A] \<Turnstile> \<phi>)}" by simp
     with \<open>val(G,\<pi>) = A\<close>
     have "x \<in> val(G,\<pi>)" by simp
     then
     obtain \<theta> q where "\<langle>\<theta>,q\<rangle>\<in>\<pi>" "q\<in>G" "val(G,\<theta>)=x" "\<theta>\<in>M"
       using elem_of_val_pair domain_trans[OF trans_M \<open>\<pi>\<in>_\<close>]
       by force
     with \<open>\<pi>\<in>M\<close> \<open>nenv \<in> _\<close> \<open>env = _\<close>
     have "[val(G,\<theta>), val(G,\<pi>)] @ env \<in> list(M[G])" "[\<theta>] @ nenv @ [\<pi>]\<in>list(M)"
       using GenExt_def by auto
     with \<open>val(G,\<theta>)=x\<close> \<open>val(G,\<pi>) = A\<close> \<open>x \<in> val(G,\<pi>)\<close> nth \<open>\<theta>\<in>M\<close> \<open>x\<in> {x \<in> A . _}\<close>
     have "M[G],  [val(G,\<theta>)] @ env @ [val(G,\<pi>)] \<Turnstile> \<cdot>\<cdot> 0 \<in> (1 +\<^sub>\<omega> length(env)) \<cdot> \<and> \<phi> \<cdot>"
       by auto
         \<comment> \<open>Recall \<^term>\<open>?\<chi> = And(Member(0,1 +\<^sub>\<omega> length(env)),\<phi>)\<close>\<close>
     with \<open>[_] @ nenv @ [_] \<in> _ \<close> map_nenv \<open>arity(?\<chi>) \<le> length(_)\<close> \<open>length(nenv) = _\<close>
     obtain r where "r\<in>G" "r \<tturnstile> ?\<chi> ([\<theta>] @ nenv @ [\<pi>])"
       using truth_lemma[OF \<open>?\<chi>\<in>_\<close>,of "[\<theta>] @ nenv @ [\<pi>]"]
       by auto
     with \<open>filter(G)\<close> and \<open>q\<in>G\<close>
     obtain p where "p\<in>G" "p\<preceq>q" "p\<preceq>r"
       unfolding filter_def compat_in_def by force
-    with \<open>r\<in>G\<close> \<open>q\<in>G\<close> \<open>G\<subseteq>P\<close>
-    have "p\<in>P" "r\<in>P" "q\<in>P" "p\<in>M"
+    with \<open>r\<in>G\<close> \<open>q\<in>G\<close> \<open>G\<subseteq>\<bbbP>\<close>
+    have "p\<in>\<bbbP>" "r\<in>\<bbbP>" "q\<in>\<bbbP>" "p\<in>M"
       using transitivity[OF _ P_in_M] subsetD
       by simp_all
     with \<open>\<phi>\<in>formula\<close> \<open>\<theta>\<in>M\<close> \<open>\<pi>\<in>M\<close> \<open>p\<preceq>r\<close> \<open>nenv \<in> _\<close> \<open>arity(?\<chi>) \<le> length(_)\<close> \<open>r \<tturnstile> ?\<chi> _\<close> \<open>env\<in>_\<close>
     have "p \<tturnstile> ?\<chi> ([\<theta>] @ nenv @ [\<pi>])"
       using strengthening_lemma
       by simp
-    with \<open>p\<in>P\<close> \<open>\<phi>\<in>formula\<close> \<open>\<theta>\<in>M\<close> \<open>\<pi>\<in>M\<close> \<open>nenv \<in> _\<close> \<open>arity(?\<chi>) \<le> length(_)\<close>
+    with \<open>p\<in>\<bbbP>\<close> \<open>\<phi>\<in>formula\<close> \<open>\<theta>\<in>M\<close> \<open>\<pi>\<in>M\<close> \<open>nenv \<in> _\<close> \<open>arity(?\<chi>) \<le> length(_)\<close>
     have "\<forall>F. M_generic(F) \<and> p \<in> F \<longrightarrow>
                  M[F],   map(val(F), [\<theta>] @ nenv @ [\<pi>]) \<Turnstile>  ?\<chi>"
       using definition_of_forcing[where \<phi>="\<cdot>\<cdot> 0 \<in> (1 +\<^sub>\<omega> length(env)) \<cdot> \<and> \<phi> \<cdot>"]
       by simp
-    with \<open>p\<in>P\<close> \<open>\<theta>\<in>M\<close>
-    have Eq6: "\<exists>\<theta>'\<in>M. \<exists>p'\<in>P.  \<langle>\<theta>,p\<rangle> = \<langle>\<theta>',p'\<rangle> \<and> (\<forall>F. M_generic(F) \<and> p' \<in> F \<longrightarrow>
+    with \<open>p\<in>\<bbbP>\<close> \<open>\<theta>\<in>M\<close>
+    have Eq6: "\<exists>\<theta>'\<in>M. \<exists>p'\<in>\<bbbP>.  \<langle>\<theta>,p\<rangle> = \<langle>\<theta>',p'\<rangle> \<and> (\<forall>F. M_generic(F) \<and> p' \<in> F \<longrightarrow>
                  M[F],   map(val(F), [\<theta>'] @ nenv @ [\<pi>]) \<Turnstile>  ?\<chi>)" by auto
-    from \<open>\<pi>\<in>M\<close> \<open>\<langle>\<theta>,q\<rangle>\<in>\<pi>\<close> \<open>\<theta>\<in>M\<close> \<open>p\<in>P\<close> \<open>p\<in>M\<close>
-    have "\<langle>\<theta>,q\<rangle> \<in> M" "\<langle>\<theta>,p\<rangle>\<in>M" "\<langle>\<theta>,p\<rangle>\<in>domain(\<pi>)\<times>P"
+    from \<open>\<pi>\<in>M\<close> \<open>\<langle>\<theta>,q\<rangle>\<in>\<pi>\<close> \<open>\<theta>\<in>M\<close> \<open>p\<in>\<bbbP>\<close> \<open>p\<in>M\<close>
+    have "\<langle>\<theta>,q\<rangle> \<in> M" "\<langle>\<theta>,p\<rangle>\<in>M" "\<langle>\<theta>,p\<rangle>\<in>domain(\<pi>)\<times>\<bbbP>"
       using pair_in_M_iff transitivity
       by auto
-    with \<open>\<theta>\<in>M\<close> Eq6 \<open>p\<in>P\<close>
-    have "M, [\<langle>\<theta>,p\<rangle>,P,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>"
+    with \<open>\<theta>\<in>M\<close> Eq6 \<open>p\<in>\<bbbP>\<close>
+    have "M, [\<langle>\<theta>,p\<rangle>,\<bbbP>,leq,\<one>,\<pi>] @ nenv \<Turnstile> ?\<psi>"
       using Equivalence by auto
-    with \<open>\<langle>\<theta>,p\<rangle>\<in>domain(\<pi>)\<times>P\<close>
+    with \<open>\<langle>\<theta>,p\<rangle>\<in>domain(\<pi>)\<times>\<bbbP>\<close>
     have "\<langle>\<theta>,p\<rangle>\<in>?n" by simp
-    with \<open>p\<in>G\<close> \<open>p\<in>P\<close>
+    with \<open>p\<in>G\<close> \<open>p\<in>\<bbbP>\<close>
     have "val(G,\<theta>)\<in>val(G,?n)"
       using val_of_elem[of \<theta> p] by simp
     with \<open>val(G,\<theta>)=x\<close>
     show "x\<in>val(G,?n)" by simp
   qed (* proof of "val(G,?m) \<subseteq> val(G,?n)" *)
   with val_m first_incl
   have "val(G,?n) = {x \<in> A. (M[G], [x] @ env @ [A] \<Turnstile> \<phi>)}" by auto
   also from \<open>A\<in>_\<close> phi \<open>env \<in> _\<close>
   have " ... = {x \<in> A. (M[G], [x] @ env \<Turnstile> \<phi>)}"
     using arity_sats_iff[where env="[_]@env"] transitivity_MG
     by auto
   finally
   show "{x \<in> A. (M[G], [x] @ env \<Turnstile> \<phi>)}\<in> M[G]"
     using \<open>?n\<in>M\<close> GenExt_def by force
 qed
 
 theorem separation_in_MG:
   assumes
     "\<phi>\<in>formula" and "arity(\<phi>) \<le> 1 +\<^sub>\<omega> length(env)" and "env\<in>list(M[G])"
   shows
     "separation(##M[G],\<lambda>x. (M[G], [x] @ env \<Turnstile> \<phi>))"
 proof -
   {
     fix A
     assume "A\<in>M[G]"
     moreover from \<open>env \<in> _\<close>
     obtain nenv where "nenv\<in>list(M)""env = map(val(G),nenv)" "length(env) = length(nenv)"
       using GenExt_def map_val[of env] by auto
     moreover note \<open>\<phi> \<in> _\<close> \<open>arity(\<phi>) \<le> _\<close> \<open>env \<in> _\<close>
     ultimately
     have "{x \<in> A . (M[G], [x] @ env \<Turnstile> \<phi>)} \<in> M[G]"
       using Collect_sats_in_MG by auto
   }
   then
   show ?thesis
     using separation_iff rev_bexI unfolding is_Collect_def by force
 qed
 
 end \<comment> \<open>\<^locale>\<open>G_generic1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/Union_Axiom.thy b/thys/Independence_CH/Union_Axiom.thy
--- a/thys/Independence_CH/Union_Axiom.thy
+++ b/thys/Independence_CH/Union_Axiom.thy
@@ -1,133 +1,133 @@
 section\<open>The Axiom of Unions in $M[G]$\<close>
 theory Union_Axiom
   imports Names
 begin
 
 definition Union_name_body :: "[i,i,i,i] \<Rightarrow> o" where
   "Union_name_body(P,leq,\<tau>,x) \<equiv> \<exists> \<sigma>\<in>domain(\<tau>) . \<exists>q\<in>P . \<exists>r\<in>P .
       \<langle>\<sigma>,q\<rangle> \<in> \<tau> \<and> \<langle>fst(x),r\<rangle> \<in> \<sigma> \<and> \<langle>snd(x),r\<rangle> \<in> leq \<and> \<langle>snd(x),q\<rangle> \<in> leq"
 
 definition Union_name :: "[i,i,i] \<Rightarrow> i" where
   "Union_name(P,leq,\<tau>) \<equiv> {u \<in> domain(\<Union>(domain(\<tau>))) \<times> P . Union_name_body(P,leq,\<tau>,u)}"
 
 context forcing_data1
 begin
 
 lemma Union_name_closed :
   assumes "\<tau> \<in> M"
-  shows "Union_name(P,leq,\<tau>) \<in> M"
+  shows "Union_name(\<bbbP>,leq,\<tau>) \<in> M"
 proof -
-  let ?Q="Union_name_body(P,leq,\<tau>)"
+  let ?Q="Union_name_body(\<bbbP>,leq,\<tau>)"
   note lr_fst2 = lam_replacement_hcomp[OF lam_replacement_fst lam_replacement_fst]
     and lr_fst3 = lam_replacement_hcomp[OF lr_fst2] lam_replacement_hcomp[OF lr_fst2 lr_fst2]
   note \<open>\<tau>\<in>M\<close>
   moreover from this
   have "domain(\<Union>(domain(\<tau>)))\<in>M" (is "?d \<in> _")
     using domain_closed Union_closed by simp
   moreover from this
-  have "?d \<times> P \<in> M"
+  have "?d \<times> \<bbbP> \<in> M"
     using cartprod_closed by simp
-  note types = assms \<open>?d\<times>P \<in> M\<close> \<open>?d\<in>M\<close>
+  note types = assms \<open>?d\<times>\<bbbP> \<in> M\<close> \<open>?d\<in>M\<close>
   ultimately
   show ?thesis
     using domain_closed pair_in_M_iff fst_closed snd_closed separation_closed
       lam_replacement_constant lam_replacement_hcomp
       lam_replacement_fst lam_replacement_snd lam_replacement_product
       separation_bex separation_conj separation_in lr_fst2 lr_fst3
       lam_replacement_hcomp[OF lr_fst3(1) lam_replacement_snd]
     unfolding Union_name_body_def Union_name_def
     by simp
 qed
 
 lemma Union_MG_Eq :
   assumes "a \<in> M[G]" and "a = val(G,\<tau>)" and "filter(G)" and "\<tau> \<in> M"
-  shows "\<Union> a = val(G,Union_name(P,leq,\<tau>))"
+  shows "\<Union> a = val(G,Union_name(\<bbbP>,leq,\<tau>))"
 proof (intro equalityI subsetI)
   fix x
   assume "x \<in> \<Union> a"
   with \<open>a=_\<close>
   have "x \<in> \<Union> (val(G,\<tau>))"
     by simp
   then
   obtain i where "i \<in> val(G,\<tau>)" "x \<in> i"
     by blast
   with \<open>\<tau> \<in> M\<close>
   obtain \<sigma> q where "q \<in> G" "\<langle>\<sigma>,q\<rangle> \<in> \<tau>" "val(G,\<sigma>) = i" "\<sigma> \<in> M"
     using elem_of_val_pair domain_trans[OF trans_M] by blast
   moreover from this \<open>x \<in> i\<close>
   obtain \<theta> r where "r \<in> G" "\<langle>\<theta>,r\<rangle> \<in> \<sigma>" "val(G,\<theta>) = x" "\<theta> \<in> M"
     using elem_of_val_pair domain_trans[OF trans_M] by blast
   moreover from calculation
   have "\<theta> \<in> domain(\<Union>(domain(\<tau>)))"
     by auto
   moreover from calculation \<open>filter(G)\<close>
-  obtain p where "p \<in> G" "\<langle>p,r\<rangle> \<in> leq" "\<langle>p,q\<rangle> \<in> leq" "p \<in> P" "r \<in> P" "q \<in> P"
+  obtain p where "p \<in> G" "\<langle>p,r\<rangle> \<in> leq" "\<langle>p,q\<rangle> \<in> leq" "p \<in> \<bbbP>" "r \<in> \<bbbP>" "q \<in> \<bbbP>"
     using low_bound_filter filterD by blast
   moreover from this
   have "p \<in> M" "q\<in>M" "r\<in>M"
     by (auto dest:transitivity)
   moreover from calculation
-  have "\<langle>\<theta>,p\<rangle> \<in> Union_name(P,leq,\<tau>)"
+  have "\<langle>\<theta>,p\<rangle> \<in> Union_name(\<bbbP>,leq,\<tau>)"
     unfolding Union_name_def Union_name_body_def
     by auto
-  moreover from this \<open>p\<in>P\<close> \<open>p\<in>G\<close>
-  have "val(G,\<theta>) \<in> val(G,Union_name(P,leq,\<tau>))"
+  moreover from this \<open>p\<in>\<bbbP>\<close> \<open>p\<in>G\<close>
+  have "val(G,\<theta>) \<in> val(G,Union_name(\<bbbP>,leq,\<tau>))"
     using val_of_elem by simp
   ultimately
-  show "x \<in> val(G,Union_name(P,leq,\<tau>))"
+  show "x \<in> val(G,Union_name(\<bbbP>,leq,\<tau>))"
     by simp
 next
   fix x
-  assume "x \<in> (val(G,Union_name(P,leq,\<tau>)))"
+  assume "x \<in> (val(G,Union_name(\<bbbP>,leq,\<tau>)))"
   moreover
   note \<open>filter(G)\<close> \<open>a=val(G,\<tau>)\<close>
   moreover from calculation
-  obtain \<theta> p where "p \<in> G" "\<langle>\<theta>,p\<rangle> \<in> Union_name(P,leq,\<tau>)" "val(G,\<theta>) = x"
+  obtain \<theta> p where "p \<in> G" "\<langle>\<theta>,p\<rangle> \<in> Union_name(\<bbbP>,leq,\<tau>)" "val(G,\<theta>) = x"
     using elem_of_val_pair by blast
   moreover from calculation
-  have "p\<in>P"
+  have "p\<in>\<bbbP>"
     using filterD by simp
   moreover from calculation
-  obtain \<sigma> q r where "\<langle>\<sigma>,q\<rangle> \<in> \<tau>" "\<langle>\<theta>,r\<rangle> \<in> \<sigma>" "\<langle>p,r\<rangle> \<in> leq" "\<langle>p,q\<rangle> \<in> leq" "r\<in>P" "q\<in>P"
+  obtain \<sigma> q r where "\<langle>\<sigma>,q\<rangle> \<in> \<tau>" "\<langle>\<theta>,r\<rangle> \<in> \<sigma>" "\<langle>p,r\<rangle> \<in> leq" "\<langle>p,q\<rangle> \<in> leq" "r\<in>\<bbbP>" "q\<in>\<bbbP>"
     unfolding Union_name_def Union_name_body_def
     by auto
   moreover from calculation
   have "r \<in> G" "q \<in> G"
     using filter_leqD by auto
-  moreover from this \<open>\<langle>\<theta>,r\<rangle> \<in> \<sigma>\<close> \<open>\<langle>\<sigma>,q\<rangle>\<in>\<tau>\<close> \<open>q\<in>P\<close> \<open>r\<in>P\<close>
+  moreover from this \<open>\<langle>\<theta>,r\<rangle> \<in> \<sigma>\<close> \<open>\<langle>\<sigma>,q\<rangle>\<in>\<tau>\<close> \<open>q\<in>\<bbbP>\<close> \<open>r\<in>\<bbbP>\<close>
   have "val(G,\<sigma>) \<in> val(G,\<tau>)" "val(G,\<theta>) \<in> val(G,\<sigma>)"
     using val_of_elem by simp+
   ultimately
   show "x \<in> \<Union> a"
     by blast
 qed
 
 lemma union_in_MG :
   assumes "filter(G)"
   shows "Union_ax(##M[G])"
   unfolding Union_ax_def
 proof(clarsimp)
   fix a
   assume "a \<in> M[G]"
   moreover
   note \<open>filter(G)\<close>
   moreover from calculation
   interpret mgtrans : M_trans "##M[G]"
     using transitivity_MG by (unfold_locales; auto)
   from calculation
   obtain \<tau> where "\<tau> \<in> M" "a=val(G,\<tau>)"
     using GenExtD by blast
   moreover from this
-  have "val(G,Union_name(P,leq,\<tau>)) \<in> M[G]"
+  have "val(G,Union_name(\<bbbP>,leq,\<tau>)) \<in> M[G]"
     using GenExtI Union_name_closed by simp
   ultimately
   show "\<exists>z\<in>M[G] . big_union(##M[G],a,z)"
     using Union_MG_Eq by auto
 qed
 
 theorem Union_MG : "M_generic(G) \<Longrightarrow> Union_ax(##M[G])"
   by (auto simp:union_in_MG)
 
 end \<comment> \<open>\<^locale>\<open>forcing_data1\<close>\<close>
 
 end
\ No newline at end of file
diff --git a/thys/Independence_CH/ZF_Trans_Interpretations.thy b/thys/Independence_CH/ZF_Trans_Interpretations.thy
--- a/thys/Independence_CH/ZF_Trans_Interpretations.thy
+++ b/thys/Independence_CH/ZF_Trans_Interpretations.thy
@@ -1,687 +1,677 @@
 section\<open>Further instances of axiom-schemes\<close>
 
 theory ZF_Trans_Interpretations
   imports
     Internal_ZFC_Axioms
     Replacement_Instances
 
 begin
 
 locale M_ZF2 = M_ZF1 +
   assumes
     replacement_ax2:
     "replacement_assm(M,env,replacement_is_order_body_fm)"
     "replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
     "replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
     "replacement_assm(M,env,replacement_is_order_eq_map_fm)"
 
 definition instances2_fms where "instances2_fms \<equiv>
   { replacement_is_order_body_fm,
     wfrec_replacement_order_pred_fm,
     replacement_HAleph_wfrec_repl_body_fm,
     replacement_is_order_eq_map_fm }"
 
 lemmas replacement_instances2_defs =
   replacement_is_order_body_fm_def wfrec_replacement_order_pred_fm_def
   replacement_HAleph_wfrec_repl_body_fm_def replacement_is_order_eq_map_fm_def
 
 declare (in M_ZF2) replacement_instances2_defs [simp]
 
 locale M_ZF2_trans = M_ZF1_trans + M_ZF2
 
 locale M_ZFC2 = M_ZFC1 + M_ZF2
 
 locale M_ZFC2_trans = M_ZFC1_trans + M_ZF2_trans + M_ZFC2
 
 locale M_ZF2_ground_notCH = M_ZF2 + M_ZF_ground_notCH
 
 locale M_ZF2_ground_notCH_trans = M_ZF2_trans + M_ZF2_ground_notCH + M_ZF_ground_notCH_trans
 
 locale M_ZFC2_ground_notCH = M_ZFC2 + M_ZF2_ground_notCH
 
 locale M_ZFC2_ground_notCH_trans = M_ZFC2_trans + M_ZFC2_ground_notCH + M_ZF2_ground_notCH_trans
 
 locale M_ZFC2_ground_CH_trans = M_ZFC2_ground_notCH_trans + M_ZF_ground_CH_trans
 
 locale M_ctm2 = M_ctm1 + M_ZF2_ground_notCH_trans
 
 locale M_ctm2_AC = M_ctm2 + M_ctm1_AC + M_ZFC2_ground_notCH_trans
 
 locale M_ctm2_AC_CH = M_ctm2_AC + M_ZFC2_ground_CH_trans
 
 lemmas (in M_ZF1_trans) separation_instances =
   separation_well_ord_iso
   separation_obase_equals separation_is_obase
   separation_PiP_rel separation_surjP_rel
   separation_radd_body separation_rmult_body
 
 context M_ZF2_trans
 begin
 
 lemma replacement_HAleph_wfrec_repl_body:
   "B\<in>M \<Longrightarrow> strong_replacement(##M, HAleph_wfrec_repl_body(##M,B))"
   using strong_replacement_rel_in_ctm[where \<phi>="HAleph_wfrec_repl_body_fm(2,0,1)" and env="[B]"]
     zero_in_M arity_HAleph_wfrec_repl_body_fm replacement_ax2(3) ord_simp_union
   by simp
 
 lemma HAleph_wfrec_repl:
   "(##M)(sa) \<Longrightarrow>
         (##M)(esa) \<Longrightarrow>
         (##M)(mesa) \<Longrightarrow>
         strong_replacement
          (##M,
           \<lambda>x z. \<exists>y[##M].
                    pair(##M, x, y, z) \<and>
                    (\<exists>f[##M].
                        (\<forall>z[##M].
                            z \<in> f \<longleftrightarrow>
                            (\<exists>xa[##M].
                                \<exists>y[##M].
                                   \<exists>xaa[##M].
                                      \<exists>sx[##M].
                                         \<exists>r_sx[##M].
                                            \<exists>f_r_sx[##M].
                                               pair(##M, xa, y, z) \<and>
                                               pair(##M, xa, x, xaa) \<and>
                                               upair(##M, xa, xa, sx) \<and>
                                               pre_image(##M, mesa, sx, r_sx) \<and> restriction(##M, f, r_sx, f_r_sx) \<and> xaa \<in> mesa \<and> is_HAleph(##M, xa, f_r_sx, y))) \<and>
                        is_HAleph(##M, x, f, y)))"
   using replacement_HAleph_wfrec_repl_body unfolding HAleph_wfrec_repl_body_def by simp
 
 lemma replacement_is_order_eq_map:
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> strong_replacement(##M, order_eq_map(##M,A,r))"
   using strong_replacement_rel_in_ctm[where \<phi>="order_eq_map_fm(2,3,0,1)" and env="[A,r]"  and f="order_eq_map(##M,A,r)"]
     order_eq_map_iff_sats[where env="[_,_,A,r]"] zero_in_M fst_snd_closed pair_in_M_iff
     arity_order_eq_map_fm ord_simp_union replacement_ax2(4)
   by simp
 
 end \<comment> \<open>\<^locale>\<open>M_ZF2_trans\<close>\<close>
 
 definition omap_wfrec_body where
   "omap_wfrec_body(A,r) \<equiv> (\<cdot>\<exists>\<cdot>image_fm(2, 0, 1) \<and> pred_set_fm(A #+ 9, 3, r #+ 9, 0) \<cdot>\<cdot>)"
 
 lemma type_omap_wfrec_body_fm :"A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> omap_wfrec_body(A,r)\<in>formula"
   unfolding omap_wfrec_body_def by simp
 
 lemma arity_aux : "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow> arity(omap_wfrec_body(A,r)) = (9+\<^sub>\<omega>A) \<union> (9+\<^sub>\<omega>r)"
   unfolding omap_wfrec_body_def
   using arity_image_fm arity_pred_set_fm pred_Un_distrib union_abs2[of 3] union_abs1
   by (simp add:FOL_arities, auto simp add:Un_assoc[symmetric] union_abs1)
 
 lemma arity_omap_wfrec: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>
   arity(is_wfrec_fm(omap_wfrec_body(A,r),succ(succ(succ(r))), 1, 0)) =
   (4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)"
   using Arities.arity_is_wfrec_fm[OF _ _ _ _ _ arity_aux,of A r "3+\<^sub>\<omega>r" 1 0] pred_Un_distrib
     union_abs1 union_abs2 type_omap_wfrec_body_fm
   by auto
 
 lemma arity_isordermap: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordermap_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordermap_fm_def
   using arity_lambda_fm[where i="(4+\<^sub>\<omega>A) \<union> (4+\<^sub>\<omega>r)",OF _ _ _ _ arity_omap_wfrec,
       unfolded omap_wfrec_body_def] pred_Un_distrib union_abs1
   by auto
 
 lemma arity_is_ordertype: "A\<in>nat \<Longrightarrow> r\<in>nat \<Longrightarrow>d\<in>nat\<Longrightarrow>
    arity(is_ordertype_fm(A,r,d)) = succ(d) \<union> (succ(A) \<union> succ(r))"
   unfolding is_ordertype_fm_def
   using arity_isordermap arity_image_fm pred_Un_distrib FOL_arities
   by auto
 
 lemma arity_is_order_body: "arity(is_order_body_fm(1,0)) = 2"
    using arity_is_order_body_fm arity_is_ordertype ord_simp_union
    by (simp add:FOL_arities)
 
 
 lemma (in M_ZF2_trans) replacement_is_order_body:
   "strong_replacement(##M, \<lambda>x z . \<exists>y[##M]. is_order_body(##M,x,y) \<and> z = \<langle>x,y\<rangle>)"
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f] \<Turnstile> (\<cdot>\<exists> \<cdot>is_order_body_fm(1,0) \<and> pair_fm(1,0,2) \<cdot>\<cdot>)",THEN iffD1])
    apply(simp add: is_order_body_iff_sats[where env="[_,_]",symmetric])
    apply(simp_all add:zero_in_M )
   apply(rule_tac replacement_ax2(1)[unfolded replacement_assm_def, rule_format, where env="[]",simplified])
     apply(simp_all add:arity_is_order_body arity pred_Un_distrib ord_simp_union)
   done
 
 definition H_order_pred where
   "H_order_pred(A,r) \<equiv>  \<lambda>x f . f `` Order.pred(A, x, r)"
 
 relationalize "H_order_pred" "is_H_order_pred"
 
 lemma (in M_basic) H_order_pred_abs :
   "M(A) \<Longrightarrow> M(r) \<Longrightarrow> M(x) \<Longrightarrow> M(f) \<Longrightarrow> M(z) \<Longrightarrow>
     is_H_order_pred(M,A,r,x,f,z) \<longleftrightarrow> z = H_order_pred(A,r,x,f)"
   unfolding is_H_order_pred_def H_order_pred_def
   by simp
 
 synthesize "is_H_order_pred" from_definition assuming "nonempty"
 
 lemma (in M_ZF2_trans) wfrec_replacement_order_pred:
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. is_H_order_pred(##M,A,r,x,g,z) , r)"
   unfolding wfrec_replacement_def is_wfrec_def M_is_recfun_def is_H_order_pred_def
   apply(rule_tac strong_replacement_cong[
         where P="\<lambda> x f. M,[x,f,r,A] \<Turnstile> order_pred_wfrec_body_fm(3,2,1,0)",THEN iffD1])
    apply(subst order_pred_wfrec_body_def[symmetric])
    apply(rule_tac order_pred_wfrec_body_iff_sats[where env="[_,_,r,A]",symmetric])
            apply(simp_all add:zero_in_M)
   apply(rule_tac replacement_ax2(2)[unfolded replacement_assm_def, rule_format, where env="[r,A]",simplified])
     apply(simp_all add: arity_order_pred_wfrec_body_fm ord_simp_union)
   done
 
 lemma (in M_ZF2_trans) wfrec_replacement_order_pred':
   "A\<in>M \<Longrightarrow> r\<in>M \<Longrightarrow> wfrec_replacement(##M, \<lambda>x g z. z = H_order_pred(A,r,x,g) , r)"
   using wfrec_replacement_cong[OF H_order_pred_abs[of A r,rule_format] refl,THEN iffD1,
       OF _ _ _ _ _ wfrec_replacement_order_pred[of A r]]
   by simp
 
 sublocale M_ZF2_trans \<subseteq> M_pre_cardinal_arith "##M"
   using separation_instances wfrec_replacement_order_pred'[unfolded H_order_pred_def]
     replacement_is_order_eq_map[unfolded order_eq_map_def]
   by unfold_locales simp_all
 
 
 definition is_well_ord_fst_snd where
   "is_well_ord_fst_snd(A,x) \<equiv> (\<exists>a[A]. \<exists>b[A]. is_well_ord(A,a,b) \<and> is_snd(A, x, b) \<and> is_fst(A, x, a))"
 
 synthesize "is_well_ord_fst_snd" from_definition assuming "nonempty"
 arity_theorem for "is_well_ord_fst_snd_fm"
 
 lemma (in M_ZF2_trans) separation_well_ord: "separation(##M, \<lambda>x. is_well_ord(##M,fst(x), snd(x)))"
   using arity_is_well_ord_fst_snd_fm is_well_ord_iff_sats[symmetric] nonempty
     fst_closed snd_closed fst_abs snd_abs
     separation_in_ctm[where env="[]" and \<phi>="is_well_ord_fst_snd_fm(0)"]
   by(simp_all add: is_well_ord_fst_snd_def)
 
 
 sublocale M_ZF2_trans \<subseteq> M_pre_aleph "##M"
   using HAleph_wfrec_repl replacement_is_order_body
     separation_well_ord separation_Pow_rel
   by unfold_locales (simp_all add: transrec_replacement_def
       wfrec_replacement_def is_wfrec_def M_is_recfun_def flip:setclass_iff)
 
 arity_theorem intermediate for "is_HAleph_fm"
 lemma arity_is_HAleph_fm: "arity(is_HAleph_fm(2, 1, 0)) = 3"
   using arity_fun_apply_fm[of "11" 0 1,simplified]
     arity_is_HAleph_fm' arity_ordinal_fm arity_is_If_fm
     arity_empty_fm arity_is_Limit_fm
     arity_is_If_fm
     arity_is_Limit_fm arity_empty_fm
     arity_Replace_fm[where i="12" and v=10 and n=3]
     pred_Un_distrib ord_simp_union
   by (simp add:FOL_arities)
 
 lemma arity_is_Aleph[arity]: "arity(is_Aleph_fm(0, 1)) = 2"
   unfolding is_Aleph_fm_def
   using arity_transrec_fm[OF _ _ _ _ arity_is_HAleph_fm] ord_simp_union
   by simp
 
 definition bex_Aleph_rel :: "[i\<Rightarrow>o,i,i] \<Rightarrow> o" where
   "bex_Aleph_rel(M,x) \<equiv> \<lambda>y. \<exists>z\<in>x. y = \<aleph>\<^bsub>z\<^esub>\<^bsup>M\<^esup>"
 
 relationalize "bex_Aleph_rel" "is_bex_Aleph"
 
 schematic_goal sats_is_bex_Aleph_fm_auto:
   "a \<in> nat \<Longrightarrow> c \<in> nat \<Longrightarrow> env \<in> list(A) \<Longrightarrow>
   a < length(env) \<Longrightarrow> c < length(env) \<Longrightarrow> 0 \<in> A \<Longrightarrow>
   is_bex_Aleph(##A, nth(a, env), nth(c, env)) \<longleftrightarrow> A, env \<Turnstile> ?fm(a, c)"
   unfolding is_bex_Aleph_def
   by (rule iff_sats | simp)+
 
 synthesize_notc "is_bex_Aleph" from_schematic
 
 lemma is_bex_Aleph_fm_type [TC]:
     "x \<in> \<omega> \<Longrightarrow> z \<in> \<omega> \<Longrightarrow> is_bex_Aleph_fm(x, z) \<in> formula"
   unfolding is_bex_Aleph_fm_def by simp
 
 lemma sats_is_bex_Aleph_fm:
     "x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     (Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)) \<longleftrightarrow>
     is_bex_Aleph(##Aa,nth(x, env), nth(z, env))"
   using sats_is_bex_Aleph_fm_auto unfolding is_bex_Aleph_def is_bex_Aleph_fm_def
   by simp
 
 lemma is_bex_Aleph_iff_sats [iff_sats]:
     "nth(x, env) = xa \<Longrightarrow>
     nth(z, env) = za \<Longrightarrow>
     x \<in> \<omega> \<Longrightarrow>
     z \<in> \<omega> \<Longrightarrow> x < length(env) \<Longrightarrow> z < length(env) \<Longrightarrow>
     env \<in> list(Aa) \<Longrightarrow>
     0 \<in> Aa \<Longrightarrow>
     is_bex_Aleph(##Aa, xa, za) \<longleftrightarrow>
     Aa, env \<Turnstile> is_bex_Aleph_fm(x, z)"
   using sats_is_bex_Aleph_fm by simp
 
 arity_theorem for "is_bex_Aleph_fm"
 
 lemma (in M_ZF1_trans) separation_is_bex_Aleph:
   assumes "(##M)(A)"
   shows "separation(##M,is_bex_Aleph(##M, A))"
   using assms separation_in_ctm[where env="[A]" and \<phi>="is_bex_Aleph_fm(1,0)",
       OF _ _ _ is_bex_Aleph_iff_sats[symmetric],
       of "\<lambda>_.A"]
     nonempty arity_is_bex_Aleph_fm is_bex_Aleph_fm_type
   by (simp add:ord_simp_union)
 
 lemma (in M_pre_aleph) bex_Aleph_rel_abs:
   assumes "Ord(u)" "M(u)" "M(v)"
   shows "is_bex_Aleph(M, u, v) \<longleftrightarrow> bex_Aleph_rel(M,u,v)"
   unfolding is_bex_Aleph_def bex_Aleph_rel_def
   using assms is_Aleph_iff transM[of _ u] Ord_in_Ord
   by simp
 
 lemma (in M_ZF2_trans) separation_bex_Aleph_rel:
   "Ord(x) \<Longrightarrow> (##M)(x) \<Longrightarrow> separation(##M, bex_Aleph_rel(##M,x))"
   using separation_is_bex_Aleph bex_Aleph_rel_abs
     separation_cong[where P="is_bex_Aleph(##M,x)" and M="##M",THEN iffD1]
   unfolding bex_Aleph_rel_def
   by simp
 
 sublocale M_ZF2_trans \<subseteq> M_aleph "##M"
   using separation_bex_Aleph_rel[unfolded bex_Aleph_rel_def]
   by unfold_locales
 
 sublocale M_ZF1_trans \<subseteq> M_FiniteFun "##M"
   using separation_is_function separation_omfunspace
   by unfold_locales simp
 
 sublocale M_ZFC2_trans \<subseteq> M_cardinal_AC "##M"
   using lam_replacement_minimum
   by unfold_locales simp
 
 (* TopLevel *)
 
 lemma (in M_ZF1_trans) separation_cardinal_rel_lesspoll_rel:
   "(##M)(\<kappa>) \<Longrightarrow> separation(##M, \<lambda>x. x \<prec>\<^bsup>M\<^esup> \<kappa>)"
   using separation_in_ctm[where \<phi>="( \<cdot>0 \<prec> 1\<cdot> )" and env="[\<kappa>]"]
     is_lesspoll_iff nonempty
     arity_is_cardinal_fm arity_is_lesspoll_fm arity_is_bij_fm ord_simp_union
   by (simp add:FOL_arities)
 
 sublocale M_ZFC2_trans \<subseteq> M_library "##M"
   using separation_cardinal_rel_lesspoll_rel lam_replacement_minimum
   by unfold_locales simp_all
 
 locale M_ZF3 = M_ZF2 +
   assumes
     ground_replacements3:
     "ground_replacement_assm(M,env,replacement_is_order_body_fm)"
     "ground_replacement_assm(M,env,wfrec_replacement_order_pred_fm)"
-    "ground_replacement_assm(M,env,list_repl1_intf_fm)"
-    "ground_replacement_assm(M,env,list_repl2_intf_fm)"
-    "ground_replacement_assm(M,env,formula_repl2_intf_fm)"
     "ground_replacement_assm(M,env,eclose_repl2_intf_fm)"
     "ground_replacement_assm(M,env,wfrec_rank_fm)"
     "ground_replacement_assm(M,env,trans_repl_HVFrom_fm)"
-    "ground_replacement_assm(M,env,tl_repl_intf_fm)"
-    "ground_replacement_assm(M,env,formula_repl1_intf_fm)"
     "ground_replacement_assm(M,env,eclose_repl1_intf_fm)"
     "ground_replacement_assm(M,env,replacement_HAleph_wfrec_repl_body_fm)"
     "ground_replacement_assm(M,env,replacement_is_order_eq_map_fm)"
 
 definition instances3_fms where "instances3_fms \<equiv>
   { ground_repl_fm(replacement_is_order_body_fm),
     ground_repl_fm(wfrec_replacement_order_pred_fm),
-    ground_repl_fm(list_repl1_intf_fm),
-    ground_repl_fm(list_repl2_intf_fm),
-    ground_repl_fm(formula_repl2_intf_fm),
     ground_repl_fm(eclose_repl2_intf_fm),
     ground_repl_fm(wfrec_rank_fm),
     ground_repl_fm(trans_repl_HVFrom_fm),
-    ground_repl_fm(tl_repl_intf_fm),
-    ground_repl_fm(formula_repl1_intf_fm),
     ground_repl_fm(eclose_repl1_intf_fm),
     ground_repl_fm(replacement_HAleph_wfrec_repl_body_fm),
     ground_repl_fm(replacement_is_order_eq_map_fm) }"
 
-text\<open>This set has $13$ internalized formulas, corresponding to the total
+text\<open>This set has $8$ internalized formulas, corresponding to the total
 count of previous replacement instances (apart from those $5$ in
 \<^term>\<open>instances_ground_fms\<close> and \<^term>\<open>instances_ground_notCH_fms\<close>,
 and \<^term>\<open>replacement_dcwit_repl_body_fm\<close>).\<close>
 
 definition overhead where
   "overhead \<equiv> instances1_fms \<union> instances_ground_fms"
 
 definition overhead_notCH where
   "overhead_notCH \<equiv> overhead \<union> instances2_fms \<union>
      instances3_fms \<union> instances_ground_notCH_fms"
 
 definition overhead_CH where
   "overhead_CH \<equiv> overhead_notCH \<union> { replacement_dcwit_repl_body_fm }"
 
 text\<open>Hence, the “overhead” to create a proper extension of a ctm by forcing
-consists of $16$ replacement instances. To force $\neg\CH$,
-31 instances are need, and one further instance is required to
+consists of $7$ replacement instances. To force $\neg\CH$,
+21 instances are need, and one further instance is required to
 force $\CH$.\<close>
 
 lemma instances2_fms_type[TC] : "instances2_fms \<subseteq> formula"
   unfolding instances2_fms_def replacement_instances2_defs
   by (auto simp del: Lambda_in_M_fm_def)
 
 lemma overhead_type: "overhead \<subseteq> formula"
   using instances1_fms_type instances_ground_fms_type
   unfolding overhead_def replacement_instances1_defs
   by simp
 
 lemma overhead_notCH_type: "overhead_notCH \<subseteq> formula"
   using overhead_type
   unfolding overhead_notCH_def replacement_transrec_apply_image_body_fm_def
     replacement_is_trans_apply_image_fm_def instances_ground_notCH_fms_def
     instances2_fms_def instances3_fms_def
   by (auto simp: replacement_instances1_defs
       replacement_instances2_defs simp del: Lambda_in_M_fm_def)
 
 lemma overhead_CH_type: "overhead_CH \<subseteq> formula"
   using overhead_notCH_type unfolding overhead_CH_def replacement_dcwit_repl_body_fm_def
   by auto
 
 locale M_ZF3_trans = M_ZF2_trans + M_ZF3
 
 locale M_ZFC3 = M_ZFC2 + M_ZF3
 
 locale M_ZFC3_trans = M_ZFC2_trans + M_ZF3_trans + M_ZFC3
 
 locale M_ctm3 = M_ctm2 + M_ZF3_trans
 
 locale M_ctm3_AC = M_ctm3 + M_ctm1_AC + M_ZFC3_trans
 
 lemma M_satT_imp_M_ZF2: "(M \<Turnstile> ZF) \<Longrightarrow> M_ZF1(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
       unfolding replacement_assm_def by simp_all
   }
   with fin
   show "M_ZF1(M)"
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 lemma M_satT_imp_M_ZFC1:
   shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC1(M)"
 proof -
   have "(M \<Turnstile> ZF) \<and> choice_ax(##M) \<longrightarrow> M_ZFC1(M)"
     using M_satT_imp_M_ZF2[of M]
     unfolding M_ZFC1_def M_ZC_basic_def M_ZF1_def M_AC_def
     by auto
   then
   show ?thesis
     unfolding ZFC_def by auto
 qed
 
 lemma M_satT_instances1_imp_M_ZF1:
   assumes "(M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms })"
   shows "M_ZF1(M)"
 proof -
   from assms
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
     from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding Zermelo_fms_def ZF_def instances1_fms_def
       by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
     assume "\<phi> \<in> instances1_fms" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances1_fms_type
       unfolding replacement_assm_def by auto
   }
   ultimately
   show ?thesis
     unfolding instances1_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_trans:
   assumes "Transset(M)" "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead}"
   shows "M_ZF_ground_trans(M)"
 proof -
   from \<open>M \<Turnstile> \<cdot>Z\<cdot> \<union> _\<close>
   have "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> instances1_fms }"
        "M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms }"
     unfolding overhead_def by auto
   then
   interpret M_ZF1 M
     using M_satT_instances1_imp_M_ZF1
     by simp
   from \<open>Transset(M)\<close>
   interpret M_ZF1_trans M
     using M_satT_imp_M_ZF2
     by unfold_locales
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_fms" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> {\<cdot>Replacement(p)\<cdot> . p \<in> instances_ground_fms}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_fms_type
       unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     unfolding instances_ground_fms_def
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_notCH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   shows "M_ZF_ground_notCH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_trans M
     using M_satT_imp_M_ZF_ground_trans unfolding overhead_notCH_def by force
   {
     fix \<phi> env
     assume "\<phi> \<in> instances_ground_notCH_fms" "env\<in>list(M)"
     moreover from this and assms
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>"
       unfolding overhead_notCH_def by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] instances_ground_notCH_fms_type
       unfolding replacement_assm_def by auto
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def instances_ground_notCH_fms_def)
 qed
 
 theorem M_satT_imp_M_ZF_ground_CH_trans:
   assumes
     "Transset(M)"
     "M \<Turnstile> \<cdot>Z\<cdot> \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_CH }"
   shows "M_ZF_ground_CH_trans(M)"
 proof -
   from assms
   interpret M_ZF_ground_notCH_trans M
     using M_satT_imp_M_ZF_ground_notCH_trans unfolding overhead_CH_def by auto
   {
     fix env
     assume "env \<in> list(M)"
     moreover from assms
     have "M, [] \<Turnstile> \<cdot>Replacement(replacement_dcwit_repl_body_fm)\<cdot>"
       unfolding overhead_CH_def by auto
     ultimately
     have "arity(replacement_dcwit_repl_body_fm) \<le> succ(succ(length(env)))
       \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,replacement_dcwit_repl_body_fm,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of replacement_dcwit_repl_body_fm]
       unfolding replacement_assm_def
       by (auto simp:replacement_dcwit_repl_body_fm_def)
   }
   then
   show ?thesis
     by unfold_locales (simp_all add:replacement_assm_def)
 qed
 
 lemma (in M_Z_basic) M_satT_Zermelo_fms: "M \<Turnstile> \<cdot>Z\<cdot>"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
   unfolding Zermelo_fms_def ZF_fin_def
   by auto
 
 lemma (in M_ZFC1) M_satT_ZC: "M \<Turnstile> ZC"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff choice_ax
   unfolding ZC_def Zermelo_fms_def ZF_fin_def
   by auto
 
 locale M_ZF = M_Z_basic +
   assumes
     replacement_ax:"replacement_assm(M,env,\<phi>)"
 
 sublocale M_ZF \<subseteq> M_ZF3
   using replacement_ax
   by unfold_locales (simp_all add:ground_replacement_assm_def)
 
 lemma M_satT_imp_M_ZF: " M \<Turnstile> ZF \<Longrightarrow> M_ZF(M)"
 proof -
   assume "M \<Turnstile> ZF"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZF_def ZF_fin_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   {
     fix \<phi> env
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     moreover from \<open>M \<Turnstile> ZF\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_replacement_fm(p)))"
       unfolding ZF_def ZF_schemes_def by auto
     moreover from calculation
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_separation_fm_iff sats_ZF_replacement_fm_iff
       unfolding replacement_assm_def by simp_all
   }
   with fin
   show "M_ZF(M)"
     unfolding M_ZF_def M_Z_basic_def M_ZF_axioms_def replacement_assm_def by simp
 qed
 
 lemma (in M_ZF) M_satT_ZF: "M \<Turnstile> ZF"
   using upair_ax Union_ax power_ax extensionality foundation_ax
     infinity_ax separation_ax sats_ZF_separation_fm_iff
     replacement_ax sats_ZF_replacement_fm_iff
   unfolding ZF_def ZF_schemes_def ZF_fin_def replacement_assm_def
   by auto
 
 lemma M_ZF_iff_M_satT: "M_ZF(M) \<longleftrightarrow> (M \<Turnstile> ZF)"
   using M_ZF.M_satT_ZF M_satT_imp_M_ZF
   by auto
 
 locale M_ZFC = M_ZF + M_ZC_basic
 
 sublocale M_ZFC \<subseteq> M_ZFC3
   by unfold_locales
 
 lemma M_ZFC_iff_M_satT:
   notes iff_trans[trans]
   shows "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZFC)"
 proof -
   have "M_ZFC(M) \<longleftrightarrow> (M \<Turnstile> ZF) \<and> choice_ax(##M)"
     using M_ZF_iff_M_satT
     unfolding M_ZFC_def M_ZC_basic_def M_AC_def M_ZF_def by auto
   also
   have " \<dots> \<longleftrightarrow> M \<Turnstile> ZFC"
     unfolding ZFC_def by auto
   ultimately
   show ?thesis by simp
 qed
 
 lemma M_satT_imp_M_ZF3: "(M \<Turnstile> ZF) \<longrightarrow> M_ZF3(M)"
 proof
   assume "M \<Turnstile> ZF"
   then
   interpret M_ZF M
     using M_satT_imp_M_ZF by simp
   show "M_ZF3(M)"
     by unfold_locales
 qed
 
 lemma M_satT_imp_M_ZFC3:
   shows "(M \<Turnstile> ZFC) \<longrightarrow> M_ZFC3(M)"
 proof
   assume "M \<Turnstile> ZFC"
   then
   interpret M_ZFC M
     using M_ZFC_iff_M_satT  by simp
   show "M_ZFC3(M)"
     by unfold_locales
 qed
 
 lemma M_satT_overhead_imp_M_ZF3:
   "(M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}) \<longrightarrow> M_ZFC3(M)"
 proof
   assume "M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}"
   then
   have fin: "upair_ax(##M)" "Union_ax(##M)" "power_ax(##M)" "choice_ax(##M)"
     "extensionality(##M)" "foundation_ax(##M)" "infinity_ax(##M)"
     unfolding ZC_def ZF_fin_def Zermelo_fms_def ZFC_fm_defs satT_def
     using ZFC_fm_sats[of M] by simp_all
   moreover
   {
     fix \<phi> env
     from \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "\<forall>p\<in>formula. (M, [] \<Turnstile> (ZF_separation_fm(p)))"
       unfolding ZC_def Zermelo_fms_def ZF_def by auto
     moreover
     assume "\<phi> \<in> formula" "env\<in>list(M)"
     ultimately
     have "arity(\<phi>) \<le> succ(length(env)) \<Longrightarrow> separation(##M, \<lambda>x. (M, Cons(x, env) \<Turnstile> \<phi>))"
       using sats_ZF_separation_fm_iff by simp_all
   }
   moreover
   {
     fix \<phi> env
     assume "\<phi> \<in> overhead_notCH" "env\<in>list(M)"
     moreover from this and \<open>M \<Turnstile> ZC \<union> {\<cdot>Replacement(p)\<cdot> . p \<in> overhead_notCH}\<close>
     have "M, [] \<Turnstile> \<cdot>Replacement(\<phi>)\<cdot>" by auto
     ultimately
     have "arity(\<phi>) \<le> succ(succ(length(env))) \<Longrightarrow> strong_replacement(##M,\<lambda>x y. sats(M,\<phi>,Cons(x,Cons(y, env))))"
       using sats_ZF_replacement_fm_iff[of \<phi>] overhead_notCH_type
       unfolding replacement_assm_def by auto
   }
   ultimately
   show "M_ZFC3(M)"
     unfolding overhead_def overhead_notCH_def instances1_fms_def
       instances2_fms_def instances3_fms_def
     by unfold_locales (simp_all add:replacement_assm_def ground_replacement_assm_def)
 qed
 
 end
\ No newline at end of file
diff --git a/thys/Transitive_Models/DPow_absolute.thy b/thys/Transitive_Models/DPow_absolute.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/DPow_absolute.thy
@@ -0,0 +1,627 @@
+(*  Title:      ZF/Constructible/DPow_absolute.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+section \<open>Absoluteness for the Definable Powerset Function\<close>
+
+
+theory DPow_absolute imports Satisfies_absolute begin
+
+
+subsection\<open>Preliminary Internalizations\<close>
+
+subsubsection\<open>The Operator \<^term>\<open>is_formula_rec\<close>\<close>
+
+text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0.  It is buried
+   within 11 quantifiers!!\<close>
+
+(* is_formula_rec :: "[i=>o, [i,i,i]=>o, i, i] => o"
+   "is_formula_rec(M,MH,p,z)  ==
+      \<exists>dp[M]. \<exists>i[M]. \<exists>f[M]. finite_ordinal(M,dp) & is_depth(M,p,dp) & 
+       2       1      0
+             successor(M,dp,i) & fun_apply(M,f,p,z) & is_transrec(M,MH,i,f)"
+*)
+
+definition
+  formula_rec_fm :: "[i, i, i]=>i" where
+ "formula_rec_fm(mh,p,z) == 
+    Exists(Exists(Exists(
+      And(finite_ordinal_fm(2),
+       And(depth_fm(p#+3,2),
+        And(succ_fm(2,1), 
+          And(fun_apply_fm(0,p#+3,z#+3), is_transrec_fm(mh,1,0))))))))"
+
+lemma is_formula_rec_type [TC]:
+     "[| p \<in> formula; x \<in> nat; z \<in> nat |] 
+      ==> formula_rec_fm(p,x,z) \<in> formula"
+by (simp add: formula_rec_fm_def) 
+
+lemma sats_formula_rec_fm:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A; a8\<in>A; a9\<in>A; a10\<in>A|]
+        ==> MH(a2, a1, a0) \<longleftrightarrow> 
+            sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
+                          Cons(a4,Cons(a5,Cons(a6,Cons(a7,
+                                  Cons(a8,Cons(a9,Cons(a10,env))))))))))))"
+  shows 
+      "[|x \<in> nat; z \<in> nat; env \<in> list(A)|]
+       ==> sats(A, formula_rec_fm(p,x,z), env) \<longleftrightarrow> 
+           is_formula_rec(##A, MH, nth(x,env), nth(z,env))"
+by (simp add: formula_rec_fm_def sats_is_transrec_fm is_formula_rec_def 
+              MH_iff_sats [THEN iff_sym])
+
+lemma formula_rec_iff_sats:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A; a8\<in>A; a9\<in>A; a10\<in>A|]
+        ==> MH(a2, a1, a0) \<longleftrightarrow> 
+            sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
+                          Cons(a4,Cons(a5,Cons(a6,Cons(a7,
+                                  Cons(a8,Cons(a9,Cons(a10,env))))))))))))"
+  shows
+  "[|nth(i,env) = x; nth(k,env) = z; 
+      i \<in> nat; k \<in> nat; env \<in> list(A)|]
+   ==> is_formula_rec(##A, MH, x, z) \<longleftrightarrow> sats(A, formula_rec_fm(p,i,k), env)" 
+by (simp add: sats_formula_rec_fm [OF MH_iff_sats])
+
+theorem formula_rec_reflection:
+  assumes MH_reflection:
+    "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
+                     \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. is_formula_rec(L, MH(L,x), f(x), h(x)), 
+               \<lambda>i x. is_formula_rec(##Lset(i), MH(##Lset(i),x), f(x), h(x))]"
+apply (simp (no_asm_use) only: is_formula_rec_def)
+apply (intro FOL_reflections function_reflections fun_plus_reflections
+             depth_reflection is_transrec_reflection MH_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_satisfies\<close>\<close>
+
+(* is_satisfies(M,A,p,z) == is_formula_rec (M, satisfies_MH(M,A), p, z) *)
+definition
+  satisfies_fm :: "[i,i,i]=>i" where
+    "satisfies_fm(x) == formula_rec_fm (satisfies_MH_fm(x#+5#+6, 2, 1, 0))"
+
+lemma is_satisfies_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> satisfies_fm(x,y,z) \<in> formula"
+by (simp add: satisfies_fm_def)
+
+lemma sats_satisfies_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_fm(x,y,z), env) \<longleftrightarrow>
+        is_satisfies(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: satisfies_fm_def is_satisfies_def sats_formula_rec_fm)
+
+lemma satisfies_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_satisfies(##A, x, y, z) \<longleftrightarrow> sats(A, satisfies_fm(i,j,k), env)"
+by (simp)
+
+theorem satisfies_reflection:
+     "REFLECTS[\<lambda>x. is_satisfies(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_satisfies(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_satisfies_def)
+apply (intro formula_rec_reflection satisfies_MH_reflection)
+done
+
+
+subsection \<open>Relativization of the Operator \<^term>\<open>DPow'\<close>\<close>
+
+lemma DPow'_eq: 
+  "DPow'(A) = {z . ep \<in> list(A) * formula, 
+                    \<exists>env \<in> list(A). \<exists>p \<in> formula. 
+                       ep = <env,p> & z = {x\<in>A. sats(A, p, Cons(x,env))}}"
+by (simp add: DPow'_def, blast) 
+
+
+text\<open>Relativize the use of \<^term>\<open>sats\<close> within \<^term>\<open>DPow'\<close>
+(the comprehension).\<close>
+definition
+  is_DPow_sats :: "[i=>o,i,i,i,i] => o" where
+   "is_DPow_sats(M,A,env,p,x) ==
+      \<forall>n1[M]. \<forall>e[M]. \<forall>sp[M]. 
+             is_satisfies(M,A,p,sp) \<longrightarrow> is_Cons(M,x,env,e) \<longrightarrow> 
+             fun_apply(M, sp, e, n1) \<longrightarrow> number1(M, n1)"
+
+lemma (in M_satisfies) DPow_sats_abs:
+    "[| M(A); env \<in> list(A); p \<in> formula; M(x) |]
+    ==> is_DPow_sats(M,A,env,p,x) \<longleftrightarrow> sats(A, p, Cons(x,env))"
+apply (subgoal_tac "M(env)") 
+ apply (simp add: is_DPow_sats_def satisfies_closed satisfies_abs) 
+apply (blast dest: transM) 
+done
+
+lemma (in M_satisfies) Collect_DPow_sats_abs:
+    "[| M(A); env \<in> list(A); p \<in> formula |]
+    ==> Collect(A, is_DPow_sats(M,A,env,p)) = 
+        {x \<in> A. sats(A, p, Cons(x,env))}"
+by (simp add: DPow_sats_abs transM [of _ A])
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_DPow_sats\<close>, Internalized\<close>
+
+(* is_DPow_sats(M,A,env,p,x) ==
+      \<forall>n1[M]. \<forall>e[M]. \<forall>sp[M]. 
+             is_satisfies(M,A,p,sp) \<longrightarrow> is_Cons(M,x,env,e) \<longrightarrow> 
+             fun_apply(M, sp, e, n1) \<longrightarrow> number1(M, n1) *)
+
+definition
+  DPow_sats_fm :: "[i,i,i,i]=>i" where
+  "DPow_sats_fm(A,env,p,x) ==
+   Forall(Forall(Forall(
+     Implies(satisfies_fm(A#+3,p#+3,0), 
+       Implies(Cons_fm(x#+3,env#+3,1), 
+         Implies(fun_apply_fm(0,1,2), number1_fm(2)))))))"
+
+lemma is_DPow_sats_type [TC]:
+     "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
+      ==> DPow_sats_fm(A,x,y,z) \<in> formula"
+by (simp add: DPow_sats_fm_def)
+
+lemma sats_DPow_sats_fm [simp]:
+   "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, DPow_sats_fm(u,x,y,z), env) \<longleftrightarrow>
+        is_DPow_sats(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: DPow_sats_fm_def is_DPow_sats_def)
+
+lemma DPow_sats_iff_sats:
+  "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
+      u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+   ==> is_DPow_sats(##A,nu,nx,ny,nz) \<longleftrightarrow>
+       sats(A, DPow_sats_fm(u,x,y,z), env)"
+by simp
+
+theorem DPow_sats_reflection:
+     "REFLECTS[\<lambda>x. is_DPow_sats(L,f(x),g(x),h(x),g'(x)),
+               \<lambda>i x. is_DPow_sats(##Lset(i),f(x),g(x),h(x),g'(x))]"
+apply (unfold is_DPow_sats_def) 
+apply (intro FOL_reflections function_reflections extra_reflections
+             satisfies_reflection)
+done
+
+
+subsection\<open>A Locale for Relativizing the Operator \<^term>\<open>DPow'\<close>\<close>
+
+locale M_DPow = M_satisfies +
+ assumes sep:
+   "[| M(A); env \<in> list(A); p \<in> formula |]
+    ==> separation(M, \<lambda>x. is_DPow_sats(M,A,env,p,x))"
+ and rep: 
+    "M(A)
+    ==> strong_replacement (M, 
+         \<lambda>ep z. \<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
+                  pair(M,env,p,ep) & 
+                  is_Collect(M, A, \<lambda>x. is_DPow_sats(M,A,env,p,x), z))"
+
+lemma (in M_DPow) sep':
+   "[| M(A); env \<in> list(A); p \<in> formula |]
+    ==> separation(M, \<lambda>x. sats(A, p, Cons(x,env)))"
+by (insert sep [of A env p], simp add: DPow_sats_abs)
+
+lemma (in M_DPow) rep':
+   "M(A)
+    ==> strong_replacement (M, 
+         \<lambda>ep z. \<exists>env\<in>list(A). \<exists>p\<in>formula.
+                  ep = <env,p> & z = {x \<in> A . sats(A, p, Cons(x, env))})" 
+by (insert rep [of A], simp add: Collect_DPow_sats_abs) 
+
+
+lemma univalent_pair_eq:
+     "univalent (M, A, \<lambda>xy z. \<exists>x\<in>B. \<exists>y\<in>C. xy = \<langle>x,y\<rangle> \<and> z = f(x,y))"
+by (simp add: univalent_def, blast) 
+
+lemma (in M_DPow) DPow'_closed: "M(A) ==> M(DPow'(A))"
+apply (simp add: DPow'_eq)
+apply (fast intro: rep' sep' univalent_pair_eq)  
+done
+
+text\<open>Relativization of the Operator \<^term>\<open>DPow'\<close>\<close>
+definition 
+  is_DPow' :: "[i=>o,i,i] => o" where
+    "is_DPow'(M,A,Z) == 
+       \<forall>X[M]. X \<in> Z \<longleftrightarrow> 
+         subset(M,X,A) & 
+           (\<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
+                    is_Collect(M, A, is_DPow_sats(M,A,env,p), X))"
+
+lemma (in M_DPow) DPow'_abs:
+    "[|M(A); M(Z)|] ==> is_DPow'(M,A,Z) \<longleftrightarrow> Z = DPow'(A)"
+apply (rule iffI)
+ prefer 2 apply (simp add: is_DPow'_def DPow'_def Collect_DPow_sats_abs) 
+apply (rule M_equalityI) 
+apply (simp add: is_DPow'_def DPow'_def Collect_DPow_sats_abs, assumption)
+apply (erule DPow'_closed)
+done
+
+
+subsection\<open>Instantiating the Locale \<open>M_DPow\<close>\<close>
+
+subsubsection\<open>The Instance of Separation\<close>
+
+lemma DPow_separation:
+    "[| L(A); env \<in> list(A); p \<in> formula |]
+     ==> separation(L, \<lambda>x. is_DPow_sats(L,A,env,p,x))"
+apply (rule gen_separation_multi [OF DPow_sats_reflection, of "{A,env,p}"], 
+       auto intro: transL)
+apply (rule_tac env="[A,env,p]" in DPow_LsetI)
+apply (rule DPow_sats_iff_sats sep_rules | simp)+
+done
+
+
+
+subsubsection\<open>The Instance of Replacement\<close>
+
+lemma DPow_replacement_Reflects:
+ "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B &
+             (\<exists>env[L]. \<exists>p[L].
+               mem_formula(L,p) & mem_list(L,A,env) & pair(L,env,p,u) &
+               is_Collect (L, A, is_DPow_sats(L,A,env,p), x)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B &
+             (\<exists>env \<in> Lset(i). \<exists>p \<in> Lset(i).
+               mem_formula(##Lset(i),p) & mem_list(##Lset(i),A,env) & 
+               pair(##Lset(i),env,p,u) &
+               is_Collect (##Lset(i), A, is_DPow_sats(##Lset(i),A,env,p), x))]"
+apply (unfold is_Collect_def) 
+apply (intro FOL_reflections function_reflections mem_formula_reflection
+          mem_list_reflection DPow_sats_reflection)
+done
+
+lemma DPow_replacement:
+    "L(A)
+    ==> strong_replacement (L, 
+         \<lambda>ep z. \<exists>env[L]. \<exists>p[L]. mem_formula(L,p) & mem_list(L,A,env) &
+                  pair(L,env,p,ep) & 
+                  is_Collect(L, A, \<lambda>x. is_DPow_sats(L,A,env,p,x), z))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{A,B}" 
+         in gen_separation_multi [OF DPow_replacement_Reflects], 
+       auto)
+apply (unfold is_Collect_def) 
+apply (rule_tac env="[A,B]" in DPow_LsetI)
+apply (rule sep_rules mem_formula_iff_sats mem_list_iff_sats 
+            DPow_sats_iff_sats | simp)+
+done
+
+
+subsubsection\<open>Actually Instantiating the Locale\<close>
+
+lemma M_DPow_axioms_L: "M_DPow_axioms(L)"
+  apply (rule M_DPow_axioms.intro)
+   apply (assumption | rule DPow_separation DPow_replacement)+
+  done
+
+theorem M_DPow_L: "M_DPow(L)"
+  apply (rule M_DPow.intro)
+   apply (rule M_satisfies_L)
+  apply (rule M_DPow_axioms_L)
+  done
+
+lemmas DPow'_closed [intro, simp] = M_DPow.DPow'_closed [OF M_DPow_L]
+  and DPow'_abs [intro, simp] = M_DPow.DPow'_abs [OF M_DPow_L]
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_Collect\<close>\<close>
+
+text\<open>The formula \<^term>\<open>is_P\<close> has one free variable, 0, and it is
+enclosed within a single quantifier.\<close>
+
+(* is_Collect :: "[i=>o,i,i=>o,i] => o"
+    "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> A & P(x)" *)
+
+definition
+  Collect_fm :: "[i, i, i]=>i" where
+ "Collect_fm(A,is_P,z) == 
+        Forall(Iff(Member(0,succ(z)),
+                   And(Member(0,succ(A)), is_P)))"
+
+lemma is_Collect_type [TC]:
+     "[| is_P \<in> formula; x \<in> nat; y \<in> nat |] 
+      ==> Collect_fm(x,is_P,y) \<in> formula"
+by (simp add: Collect_fm_def)
+
+lemma sats_Collect_fm:
+  assumes is_P_iff_sats: 
+      "!!a. a \<in> A ==> is_P(a) \<longleftrightarrow> sats(A, p, Cons(a, env))"
+  shows 
+      "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
+       ==> sats(A, Collect_fm(x,p,y), env) \<longleftrightarrow>
+           is_Collect(##A, nth(x,env), is_P, nth(y,env))"
+by (simp add: Collect_fm_def is_Collect_def is_P_iff_sats [THEN iff_sym])
+
+lemma Collect_iff_sats:
+  assumes is_P_iff_sats: 
+      "!!a. a \<in> A ==> is_P(a) \<longleftrightarrow> sats(A, p, Cons(a, env))"
+  shows 
+  "[| nth(i,env) = x; nth(j,env) = y;
+      i \<in> nat; j \<in> nat; env \<in> list(A)|]
+   ==> is_Collect(##A, x, is_P, y) \<longleftrightarrow> sats(A, Collect_fm(i,p,j), env)"
+by (simp add: sats_Collect_fm [OF is_P_iff_sats])
+
+
+text\<open>The second argument of \<^term>\<open>is_P\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.\<close>
+theorem Collect_reflection:
+  assumes is_P_reflection:
+    "!!h f g. REFLECTS[\<lambda>x. is_P(L, f(x), g(x)),
+                     \<lambda>i x. is_P(##Lset(i), f(x), g(x))]"
+  shows "REFLECTS[\<lambda>x. is_Collect(L, f(x), is_P(L,x), g(x)),
+               \<lambda>i x. is_Collect(##Lset(i), f(x), is_P(##Lset(i), x), g(x))]"
+apply (simp (no_asm_use) only: is_Collect_def)
+apply (intro FOL_reflections is_P_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_Replace\<close>\<close>
+
+text\<open>BEWARE!  The formula \<^term>\<open>is_P\<close> has free variables 0, 1
+ and not the usual 1, 0!  It is enclosed within two quantifiers.\<close>
+
+(*  is_Replace :: "[i=>o,i,[i,i]=>o,i] => o"
+    "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,u))" *)
+
+definition
+  Replace_fm :: "[i, i, i]=>i" where
+  "Replace_fm(A,is_P,z) == 
+        Forall(Iff(Member(0,succ(z)),
+                   Exists(And(Member(0,A#+2), is_P))))"
+
+lemma is_Replace_type [TC]:
+     "[| is_P \<in> formula; x \<in> nat; y \<in> nat |] 
+      ==> Replace_fm(x,is_P,y) \<in> formula"
+by (simp add: Replace_fm_def)
+
+lemma sats_Replace_fm:
+  assumes is_P_iff_sats: 
+      "!!a b. [|a \<in> A; b \<in> A|] 
+              ==> is_P(a,b) \<longleftrightarrow> sats(A, p, Cons(a,Cons(b,env)))"
+  shows 
+      "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
+       ==> sats(A, Replace_fm(x,p,y), env) \<longleftrightarrow>
+           is_Replace(##A, nth(x,env), is_P, nth(y,env))"
+by (simp add: Replace_fm_def is_Replace_def is_P_iff_sats [THEN iff_sym])
+
+lemma Replace_iff_sats:
+  assumes is_P_iff_sats: 
+      "!!a b. [|a \<in> A; b \<in> A|] 
+              ==> is_P(a,b) \<longleftrightarrow> sats(A, p, Cons(a,Cons(b,env)))"
+  shows 
+  "[| nth(i,env) = x; nth(j,env) = y;
+      i \<in> nat; j \<in> nat; env \<in> list(A)|]
+   ==> is_Replace(##A, x, is_P, y) \<longleftrightarrow> sats(A, Replace_fm(i,p,j), env)"
+by (simp add: sats_Replace_fm [OF is_P_iff_sats])
+
+
+text\<open>The second argument of \<^term>\<open>is_P\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.\<close>
+theorem Replace_reflection:
+  assumes is_P_reflection:
+    "!!h f g. REFLECTS[\<lambda>x. is_P(L, f(x), g(x), h(x)),
+                     \<lambda>i x. is_P(##Lset(i), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. is_Replace(L, f(x), is_P(L,x), g(x)),
+               \<lambda>i x. is_Replace(##Lset(i), f(x), is_P(##Lset(i), x), g(x))]"
+apply (simp (no_asm_use) only: is_Replace_def)
+apply (intro FOL_reflections is_P_reflection)
+done
+
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_DPow'\<close>, Internalized\<close>
+
+(*  "is_DPow'(M,A,Z) == 
+       \<forall>X[M]. X \<in> Z \<longleftrightarrow> 
+         subset(M,X,A) & 
+           (\<exists>env[M]. \<exists>p[M]. mem_formula(M,p) & mem_list(M,A,env) &
+                    is_Collect(M, A, is_DPow_sats(M,A,env,p), X))" *)
+
+definition
+  DPow'_fm :: "[i,i]=>i" where
+    "DPow'_fm(A,Z) == 
+      Forall(
+       Iff(Member(0,succ(Z)),
+        And(subset_fm(0,succ(A)),
+         Exists(Exists(
+          And(mem_formula_fm(0),
+           And(mem_list_fm(A#+3,1),
+            Collect_fm(A#+3, 
+                       DPow_sats_fm(A#+4, 2, 1, 0), 2))))))))"
+
+lemma is_DPow'_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> DPow'_fm(x,y) \<in> formula"
+by (simp add: DPow'_fm_def)
+
+lemma sats_DPow'_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, DPow'_fm(x,y), env) \<longleftrightarrow>
+        is_DPow'(##A, nth(x,env), nth(y,env))"
+by (simp add: DPow'_fm_def is_DPow'_def sats_subset_fm' sats_Collect_fm)
+
+lemma DPow'_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; 
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_DPow'(##A, x, y) \<longleftrightarrow> sats(A, DPow'_fm(i,j), env)"
+by (simp)
+
+theorem DPow'_reflection:
+     "REFLECTS[\<lambda>x. is_DPow'(L,f(x),g(x)),
+               \<lambda>i x. is_DPow'(##Lset(i),f(x),g(x))]"
+apply (simp only: is_DPow'_def)
+apply (intro FOL_reflections function_reflections mem_formula_reflection
+             mem_list_reflection Collect_reflection DPow_sats_reflection)
+done
+
+
+subsection\<open>A Locale for Relativizing the Operator \<^term>\<open>Lset\<close>\<close>
+
+definition
+  transrec_body :: "[i=>o,i,i,i,i] => o" where
+    "transrec_body(M,g,x) ==
+      \<lambda>y z. \<exists>gy[M]. y \<in> x & fun_apply(M,g,y,gy) & is_DPow'(M,gy,z)"
+
+lemma (in M_DPow) transrec_body_abs:
+     "[|M(x); M(g); M(z)|]
+    ==> transrec_body(M,g,x,y,z) \<longleftrightarrow> y \<in> x & z = DPow'(g`y)"
+by (simp add: transrec_body_def DPow'_abs transM [of _ x])
+
+locale M_Lset = M_DPow +
+ assumes strong_rep:
+   "[|M(x); M(g)|] ==> strong_replacement(M, \<lambda>y z. transrec_body(M,g,x,y,z))"
+ and transrec_rep: 
+    "M(i) ==> transrec_replacement(M, \<lambda>x f u. 
+              \<exists>r[M]. is_Replace(M, x, transrec_body(M,f,x), r) & 
+                     big_union(M, r, u), i)"
+
+
+lemma (in M_Lset) strong_rep':
+   "[|M(x); M(g)|]
+    ==> strong_replacement(M, \<lambda>y z. y \<in> x & z = DPow'(g`y))"
+by (insert strong_rep [of x g], simp add: transrec_body_abs)
+
+lemma (in M_Lset) DPow_apply_closed:
+   "[|M(f); M(x); y\<in>x|] ==> M(DPow'(f`y))"
+by (blast intro: DPow'_closed dest: transM) 
+
+lemma (in M_Lset) RepFun_DPow_apply_closed:
+   "[|M(f); M(x)|] ==> M({DPow'(f`y). y\<in>x})"
+by (blast intro: DPow_apply_closed RepFun_closed2 strong_rep') 
+
+lemma (in M_Lset) RepFun_DPow_abs:
+     "[|M(x); M(f); M(r) |]
+      ==> is_Replace(M, x, \<lambda>y z. transrec_body(M,f,x,y,z), r) \<longleftrightarrow>
+          r =  {DPow'(f`y). y\<in>x}"
+apply (simp add: transrec_body_abs RepFun_def) 
+apply (rule iff_trans) 
+apply (rule Replace_abs) 
+apply (simp_all add: DPow_apply_closed strong_rep') 
+done
+
+lemma (in M_Lset) transrec_rep':
+   "M(i) ==> transrec_replacement(M, \<lambda>x f u. u = (\<Union>y\<in>x. DPow'(f ` y)), i)"
+apply (insert transrec_rep [of i]) 
+apply (simp add: RepFun_DPow_apply_closed RepFun_DPow_abs 
+       transrec_replacement_def) 
+done
+
+
+text\<open>Relativization of the Operator \<^term>\<open>Lset\<close>\<close>
+
+definition
+  is_Lset :: "[i=>o, i, i] => o" where
+   \<comment> \<open>We can use the term language below because \<^term>\<open>is_Lset\<close> will
+       not have to be internalized: it isn't used in any instance of
+       separation.\<close>
+   "is_Lset(M,a,z) == is_transrec(M, %x f u. u = (\<Union>y\<in>x. DPow'(f`y)), a, z)"
+
+lemma (in M_Lset) Lset_abs:
+  "[|Ord(i);  M(i);  M(z)|] 
+   ==> is_Lset(M,i,z) \<longleftrightarrow> z = Lset(i)"
+apply (simp add: is_Lset_def Lset_eq_transrec_DPow') 
+apply (rule transrec_abs)  
+apply (simp_all add: transrec_rep' relation2_def RepFun_DPow_apply_closed)
+done
+
+lemma (in M_Lset) Lset_closed:
+  "[|Ord(i);  M(i)|] ==> M(Lset(i))"
+apply (simp add: Lset_eq_transrec_DPow') 
+apply (rule transrec_closed [OF transrec_rep']) 
+apply (simp_all add: relation2_def RepFun_DPow_apply_closed)
+done
+
+
+subsection\<open>Instantiating the Locale \<open>M_Lset\<close>\<close>
+
+subsubsection\<open>The First Instance of Replacement\<close>
+
+lemma strong_rep_Reflects:
+ "REFLECTS [\<lambda>u. \<exists>v[L]. v \<in> B & (\<exists>gy[L].
+                          v \<in> x & fun_apply(L,g,v,gy) & is_DPow'(L,gy,u)),
+   \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B & (\<exists>gy \<in> Lset(i).
+            v \<in> x & fun_apply(##Lset(i),g,v,gy) & is_DPow'(##Lset(i),gy,u))]"
+by (intro FOL_reflections function_reflections DPow'_reflection)
+
+lemma strong_rep:
+   "[|L(x); L(g)|] ==> strong_replacement(L, \<lambda>y z. transrec_body(L,g,x,y,z))"
+apply (unfold transrec_body_def)  
+apply (rule strong_replacementI) 
+apply (rule_tac u="{x,g,B}" 
+         in gen_separation_multi [OF strong_rep_Reflects], auto)
+apply (rule_tac env="[x,g,B]" in DPow_LsetI)
+apply (rule sep_rules DPow'_iff_sats | simp)+
+done
+
+
+subsubsection\<open>The Second Instance of Replacement\<close>
+
+lemma transrec_rep_Reflects:
+ "REFLECTS [\<lambda>x. \<exists>v[L]. v \<in> B &
+              (\<exists>y[L]. pair(L,v,y,x) &
+             is_wfrec (L, \<lambda>x f u. \<exists>r[L].
+                is_Replace (L, x, \<lambda>y z. 
+                     \<exists>gy[L]. y \<in> x & fun_apply(L,f,y,gy) & 
+                      is_DPow'(L,gy,z), r) & big_union(L,r,u), mr, v, y)),
+    \<lambda>i x. \<exists>v \<in> Lset(i). v \<in> B &
+              (\<exists>y \<in> Lset(i). pair(##Lset(i),v,y,x) &
+             is_wfrec (##Lset(i), \<lambda>x f u. \<exists>r \<in> Lset(i).
+                is_Replace (##Lset(i), x, \<lambda>y z. 
+                     \<exists>gy \<in> Lset(i). y \<in> x & fun_apply(##Lset(i),f,y,gy) & 
+                      is_DPow'(##Lset(i),gy,z), r) & 
+                      big_union(##Lset(i),r,u), mr, v, y))]" 
+apply (simp only: rex_setclass_is_bex [symmetric])
+  \<comment> \<open>Convert \<open>\<exists>y\<in>Lset(i)\<close> to \<open>\<exists>y[##Lset(i)]\<close> within the body
+       of the \<^term>\<open>is_wfrec\<close> application.\<close>
+apply (intro FOL_reflections function_reflections 
+          is_wfrec_reflection Replace_reflection DPow'_reflection) 
+done
+
+
+lemma transrec_rep: 
+    "[|L(j)|]
+    ==> transrec_replacement(L, \<lambda>x f u. 
+              \<exists>r[L]. is_Replace(L, x, transrec_body(L,f,x), r) & 
+                     big_union(L, r, u), j)"
+apply (rule L.transrec_replacementI, assumption)
+apply (unfold transrec_body_def)  
+apply (rule strong_replacementI)
+apply (rule_tac u="{j,B,Memrel(eclose({j}))}" 
+         in gen_separation_multi [OF transrec_rep_Reflects], auto)
+apply (rule_tac env="[j,B,Memrel(eclose({j}))]" in DPow_LsetI)
+apply (rule sep_rules is_wfrec_iff_sats Replace_iff_sats DPow'_iff_sats | 
+       simp)+
+done
+
+
+subsubsection\<open>Actually Instantiating \<open>M_Lset\<close>\<close>
+
+lemma M_Lset_axioms_L: "M_Lset_axioms(L)"
+  apply (rule M_Lset_axioms.intro)
+       apply (assumption | rule strong_rep transrec_rep)+
+  done
+
+theorem M_Lset_L: "M_Lset(L)"
+  apply (rule M_Lset.intro) 
+   apply (rule M_DPow_L)
+  apply (rule M_Lset_axioms_L) 
+  done
+
+text\<open>Finally: the point of the whole theory!\<close>
+lemmas Lset_closed = M_Lset.Lset_closed [OF M_Lset_L]
+   and Lset_abs = M_Lset.Lset_abs [OF M_Lset_L]
+
+
+subsection\<open>The Notion of Constructible Set\<close>
+
+definition
+  constructible :: "[i=>o,i] => o" where
+    "constructible(M,x) ==
+       \<exists>i[M]. \<exists>Li[M]. ordinal(M,i) & is_Lset(M,i,Li) & x \<in> Li"
+
+theorem V_equals_L_in_L:
+  "L(x) \<longleftrightarrow> constructible(L,x)"
+apply (simp add: constructible_def Lset_abs Lset_closed)
+apply (simp add: L_def)
+apply (blast intro: Ord_in_L) 
+done
+
+end
diff --git a/thys/Transitive_Models/Datatype_absolute.thy b/thys/Transitive_Models/Datatype_absolute.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/Datatype_absolute.thy
@@ -0,0 +1,294 @@
+(*  Title:      ZF/Constructible/Datatype_absolute.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+section \<open>Absoluteness Properties for Recursive Datatypes\<close>
+
+theory Datatype_absolute imports Eclose_Absolute begin
+
+locale M_datatypes = M_trancl +
+ assumes list_replacement1:
+   "M(A) ==> iterates_replacement(M, is_list_functor(M,A), 0)"
+  and list_replacement2:
+   "M(A) ==> strong_replacement(M,
+         \<lambda>n y. n\<in>nat & is_iterates(M, is_list_functor(M,A), 0, n, y))"
+  and formula_replacement1:
+   "iterates_replacement(M, is_formula_functor(M), 0)"
+  and formula_replacement2:
+   "strong_replacement(M,
+         \<lambda>n y. n\<in>nat & is_iterates(M, is_formula_functor(M), 0, n, y))"
+  and nth_replacement:
+   "M(l) ==> iterates_replacement(M, %l t. is_tl(M,l,t), l)"
+
+
+subsubsection\<open>Absoluteness of the List Construction\<close>
+
+lemma (in M_datatypes) list_replacement2':
+  "M(A) ==> strong_replacement(M, \<lambda>n y. n\<in>nat & y = (\<lambda>X. {0} + A * X)^n (0))"
+apply (insert list_replacement2 [of A])
+apply (rule strong_replacement_cong [THEN iffD1])
+apply (rule conj_cong [OF iff_refl iterates_abs [of "is_list_functor(M,A)"]])
+apply (simp_all add: list_replacement1 relation1_def)
+done
+
+lemma (in M_datatypes) list_closed [intro,simp]:
+     "M(A) ==> M(list(A))"
+apply (insert list_replacement1)
+by  (simp add: RepFun_closed2 list_eq_Union
+               list_replacement2' relation1_def
+               iterates_closed [of "is_list_functor(M,A)"])
+
+text\<open>WARNING: use only with \<open>dest:\<close> or with variables fixed!\<close>
+lemmas (in M_datatypes) list_into_M = transM [OF _ list_closed]
+
+lemma (in M_datatypes) list_N_abs [simp]:
+     "[|M(A); n\<in>nat; M(Z)|]
+      ==> is_list_N(M,A,n,Z) \<longleftrightarrow> Z = list_N(A,n)"
+apply (insert list_replacement1)
+apply (simp add: is_list_N_def list_N_def relation1_def nat_into_M
+                 iterates_abs [of "is_list_functor(M,A)" _ "\<lambda>X. {0} + A*X"])
+done
+
+lemma (in M_datatypes) list_N_closed [intro,simp]:
+     "[|M(A); n\<in>nat|] ==> M(list_N(A,n))"
+apply (insert list_replacement1)
+apply (simp add: is_list_N_def list_N_def relation1_def nat_into_M
+                 iterates_closed [of "is_list_functor(M,A)"])
+done
+
+lemma (in M_datatypes) mem_list_abs [simp]:
+     "M(A) ==> mem_list(M,A,l) \<longleftrightarrow> l \<in> list(A)"
+apply (insert list_replacement1)
+apply (simp add: mem_list_def list_N_def relation1_def list_eq_Union
+                 iterates_closed [of "is_list_functor(M,A)"])
+done
+
+lemma (in M_datatypes) list_abs [simp]:
+     "[|M(A); M(Z)|] ==> is_list(M,A,Z) \<longleftrightarrow> Z = list(A)"
+apply (simp add: is_list_def, safe)
+apply (rule M_equalityI, simp_all)
+done
+
+subsubsection\<open>Absoluteness of Formulas\<close>
+
+lemma (in M_datatypes) formula_replacement2':
+  "strong_replacement(M, \<lambda>n y. n\<in>nat & y = (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))^n (0))"
+apply (insert formula_replacement2)
+apply (rule strong_replacement_cong [THEN iffD1])
+apply (rule conj_cong [OF iff_refl iterates_abs [of "is_formula_functor(M)"]])
+apply (simp_all add: formula_replacement1 relation1_def)
+done
+
+lemma (in M_datatypes) formula_closed [intro,simp]:
+     "M(formula)"
+apply (insert formula_replacement1)
+apply  (simp add: RepFun_closed2 formula_eq_Union
+                  formula_replacement2' relation1_def
+                  iterates_closed [of "is_formula_functor(M)"])
+done
+
+lemmas (in M_datatypes) formula_into_M = transM [OF _ formula_closed]
+
+lemma (in M_datatypes) formula_N_abs [simp]:
+     "[|n\<in>nat; M(Z)|]
+      ==> is_formula_N(M,n,Z) \<longleftrightarrow> Z = formula_N(n)"
+apply (insert formula_replacement1)
+apply (simp add: is_formula_N_def formula_N_def relation1_def nat_into_M
+                 iterates_abs [of "is_formula_functor(M)" _
+                                  "\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)"])
+done
+
+lemma (in M_datatypes) formula_N_closed [intro,simp]:
+     "n\<in>nat ==> M(formula_N(n))"
+apply (insert formula_replacement1)
+apply (simp add: is_formula_N_def formula_N_def relation1_def nat_into_M
+                 iterates_closed [of "is_formula_functor(M)"])
+done
+
+lemma (in M_datatypes) mem_formula_abs [simp]:
+     "mem_formula(M,l) \<longleftrightarrow> l \<in> formula"
+apply (insert formula_replacement1)
+apply (simp add: mem_formula_def relation1_def formula_eq_Union formula_N_def
+                 iterates_closed [of "is_formula_functor(M)"])
+done
+
+lemma (in M_datatypes) formula_abs [simp]:
+     "[|M(Z)|] ==> is_formula(M,Z) \<longleftrightarrow> Z = formula"
+apply (simp add: is_formula_def, safe)
+apply (rule M_equalityI, simp_all)
+done
+
+
+
+lemma (in M_datatypes) length_abs [simp]:
+     "[|M(A); l \<in> list(A); n \<in> nat|] ==> is_length(M,A,l,n) \<longleftrightarrow> n = length(l)"
+apply (subgoal_tac "M(l) & M(n)")
+ prefer 2 apply (blast dest: transM)
+apply (simp add: is_length_def)
+apply (blast intro: list_imp_list_N nat_into_Ord list_N_imp_eq_length
+             dest: list_N_imp_length_lt)
+done
+
+
+
+definition
+  is_nth :: "[i=>o,i,i,i] => o" where
+    "is_nth(M,n,l,Z) ==
+      \<exists>X[M]. is_iterates(M, is_tl(M), l, n, X) & is_hd(M,X,Z)"
+
+lemma (in M_datatypes) nth_abs [simp]:
+     "[|M(A); n \<in> nat; l \<in> list(A); M(Z)|]
+      ==> is_nth(M,n,l,Z) \<longleftrightarrow> Z = nth(n,l)"
+apply (subgoal_tac "M(l)")
+ prefer 2 apply (blast intro: transM)
+apply (simp add: is_nth_def nth_eq_hd_iterates_tl nat_into_M
+                 tl'_closed iterates_tl'_closed
+                 iterates_abs [OF _ relation1_tl] nth_replacement)
+done
+
+
+
+lemma (in M_datatypes) depth_abs [simp]:
+     "[|p \<in> formula; n \<in> nat|] ==> is_depth(M,p,n) \<longleftrightarrow> n = depth(p)"
+apply (subgoal_tac "M(p) & M(n)")
+ prefer 2 apply (blast dest: transM)
+apply (simp add: is_depth_def)
+apply (blast intro: formula_imp_formula_N nat_into_Ord formula_N_imp_eq_depth
+             dest: formula_N_imp_depth_lt)
+done
+
+
+subsubsection\<open>\<^term>\<open>is_formula_case\<close>: relativization of \<^term>\<open>formula_case\<close>\<close>
+
+definition
+ is_formula_case ::
+    "[i=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i]=>o, i, i] => o" where
+  \<comment> \<open>no constraint on non-formulas\<close>
+  "is_formula_case(M, is_a, is_b, is_c, is_d, p, z) ==
+      (\<forall>x[M]. \<forall>y[M]. finite_ordinal(M,x) \<longrightarrow> finite_ordinal(M,y) \<longrightarrow>
+                      is_Member(M,x,y,p) \<longrightarrow> is_a(x,y,z)) &
+      (\<forall>x[M]. \<forall>y[M]. finite_ordinal(M,x) \<longrightarrow> finite_ordinal(M,y) \<longrightarrow>
+                      is_Equal(M,x,y,p) \<longrightarrow> is_b(x,y,z)) &
+      (\<forall>x[M]. \<forall>y[M]. mem_formula(M,x) \<longrightarrow> mem_formula(M,y) \<longrightarrow>
+                     is_Nand(M,x,y,p) \<longrightarrow> is_c(x,y,z)) &
+      (\<forall>x[M]. mem_formula(M,x) \<longrightarrow> is_Forall(M,x,p) \<longrightarrow> is_d(x,z))"
+
+lemma (in M_datatypes) formula_case_abs [simp]:
+     "[| Relation2(M,nat,nat,is_a,a); Relation2(M,nat,nat,is_b,b);
+         Relation2(M,formula,formula,is_c,c); Relation1(M,formula,is_d,d);
+         p \<in> formula; M(z) |]
+      ==> is_formula_case(M,is_a,is_b,is_c,is_d,p,z) \<longleftrightarrow>
+          z = formula_case(a,b,c,d,p)"
+apply (simp add: formula_into_M is_formula_case_def)
+apply (erule formula.cases)
+   apply (simp_all add: Relation1_def Relation2_def)
+done
+
+lemma (in M_datatypes) formula_case_closed [intro,simp]:
+  "[|p \<in> formula;
+     \<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> M(a(x,y));
+     \<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> M(b(x,y));
+     \<forall>x[M]. \<forall>y[M]. x\<in>formula \<longrightarrow> y\<in>formula \<longrightarrow> M(c(x,y));
+     \<forall>x[M]. x\<in>formula \<longrightarrow> M(d(x))|] ==> M(formula_case(a,b,c,d,p))"
+by (erule formula.cases, simp_all)
+
+
+subsubsection \<open>Absoluteness for \<^term>\<open>formula_rec\<close>: Final Results\<close>
+
+definition
+  is_formula_rec :: "[i=>o, [i,i,i]=>o, i, i] => o" where
+    \<comment> \<open>predicate to relativize the functional \<^term>\<open>formula_rec\<close>\<close>
+   "is_formula_rec(M,MH,p,z)  ==
+      \<exists>dp[M]. \<exists>i[M]. \<exists>f[M]. finite_ordinal(M,dp) & is_depth(M,p,dp) &
+             successor(M,dp,i) & fun_apply(M,f,p,z) & is_transrec(M,MH,i,f)"
+
+
+text\<open>Sufficient conditions to relativize the instance of \<^term>\<open>formula_case\<close>
+      in \<^term>\<open>formula_rec\<close>\<close>
+lemma (in M_datatypes) Relation1_formula_rec_case:
+     "[|Relation2(M, nat, nat, is_a, a);
+        Relation2(M, nat, nat, is_b, b);
+        Relation2 (M, formula, formula,
+           is_c, \<lambda>u v. c(u, v, h`succ(depth(u))`u, h`succ(depth(v))`v));
+        Relation1(M, formula,
+           is_d, \<lambda>u. d(u, h ` succ(depth(u)) ` u));
+        M(h) |]
+      ==> Relation1(M, formula,
+                         is_formula_case (M, is_a, is_b, is_c, is_d),
+                         formula_rec_case(a, b, c, d, h))"
+apply (simp (no_asm) add: formula_rec_case_def Relation1_def)
+apply (simp)
+done
+
+
+text\<open>This locale packages the premises of the following theorems,
+      which is the normal purpose of locales.  It doesn't accumulate
+      constraints on the class \<^term>\<open>M\<close>, as in most of this development.\<close>
+locale Formula_Rec = M_eclose + M_datatypes +
+  fixes a and is_a and b and is_b and c and is_c and d and is_d and MH
+  defines
+      "MH(u::i,f,z) ==
+        \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
+             is_lambda
+         (M, fml, is_formula_case (M, is_a, is_b, is_c(f), is_d(f)), z)"
+
+  assumes a_closed: "[|x\<in>nat; y\<in>nat|] ==> M(a(x,y))"
+      and a_rel:    "Relation2(M, nat, nat, is_a, a)"
+      and b_closed: "[|x\<in>nat; y\<in>nat|] ==> M(b(x,y))"
+      and b_rel:    "Relation2(M, nat, nat, is_b, b)"
+      and c_closed: "[|x \<in> formula; y \<in> formula; M(gx); M(gy)|]
+                     ==> M(c(x, y, gx, gy))"
+      and c_rel:
+         "M(f) ==>
+          Relation2 (M, formula, formula, is_c(f),
+             \<lambda>u v. c(u, v, f ` succ(depth(u)) ` u, f ` succ(depth(v)) ` v))"
+      and d_closed: "[|x \<in> formula; M(gx)|] ==> M(d(x, gx))"
+      and d_rel:
+         "M(f) ==>
+          Relation1(M, formula, is_d(f), \<lambda>u. d(u, f ` succ(depth(u)) ` u))"
+      and fr_replace: "n \<in> nat ==> transrec_replacement(M,MH,n)"
+      and fr_lam_replace:
+           "M(g) ==>
+            strong_replacement
+              (M, \<lambda>x y. x \<in> formula &
+                  y = \<langle>x, formula_rec_case(a,b,c,d,g,x)\<rangle>)"
+
+lemma (in Formula_Rec) formula_rec_case_closed:
+    "[|M(g); p \<in> formula|] ==> M(formula_rec_case(a, b, c, d, g, p))"
+by (simp add: formula_rec_case_def a_closed b_closed c_closed d_closed)
+
+lemma (in Formula_Rec) formula_rec_lam_closed:
+    "M(g) ==> M(Lambda (formula, formula_rec_case(a,b,c,d,g)))"
+by (simp add: lam_closed2 fr_lam_replace formula_rec_case_closed)
+
+lemma (in Formula_Rec) MH_rel2:
+     "relation2 (M, MH,
+             \<lambda>x h. Lambda (formula, formula_rec_case(a,b,c,d,h)))"
+apply (simp add: relation2_def MH_def, clarify)
+apply (rule lambda_abs2)
+apply (rule Relation1_formula_rec_case)
+apply (simp_all add: a_rel b_rel c_rel d_rel formula_rec_case_closed)
+done
+
+lemma (in Formula_Rec) fr_transrec_closed:
+    "n \<in> nat
+     ==> M(transrec
+          (n, \<lambda>x h. Lambda(formula, formula_rec_case(a, b, c, d, h))))"
+by (simp add: transrec_closed [OF fr_replace MH_rel2]
+              nat_into_M formula_rec_lam_closed)
+
+text\<open>The main two results: \<^term>\<open>formula_rec\<close> is absolute for \<^term>\<open>M\<close>.\<close>
+theorem (in Formula_Rec) formula_rec_closed:
+    "p \<in> formula ==> M(formula_rec(a,b,c,d,p))"
+by (simp add: formula_rec_eq fr_transrec_closed
+              transM [OF _ formula_closed])
+
+theorem (in Formula_Rec) formula_rec_abs:
+  "[| p \<in> formula; M(z)|]
+   ==> is_formula_rec(M,MH,p,z) \<longleftrightarrow> z = formula_rec(a,b,c,d,p)"
+by (simp add: is_formula_rec_def formula_rec_eq transM [OF _ formula_closed]
+              transrec_abs [OF fr_replace MH_rel2] depth_type
+              fr_transrec_closed formula_rec_lam_closed eq_commute)
+
+
+end
diff --git a/thys/Transitive_Models/Eclose_Absolute.thy b/thys/Transitive_Models/Eclose_Absolute.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/Eclose_Absolute.thy
@@ -0,0 +1,740 @@
+(*  Title:      ZF/Constructible/Datatype_absolute.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+section \<open>Absoluteness Properties for Recursive Datatypes\<close>
+
+theory Eclose_Absolute imports "ZF-Constructible.Formula" "ZF-Constructible.WF_absolute" begin
+
+
+subsection\<open>The lfp of a continuous function can be expressed as a union\<close>
+
+definition
+  directed :: "i=>o" where
+   "directed(A) == A\<noteq>0 & (\<forall>x\<in>A. \<forall>y\<in>A. x \<union> y \<in> A)"
+
+definition
+  contin :: "(i=>i) => o" where
+   "contin(h) == (\<forall>A. directed(A) \<longrightarrow> h(\<Union>A) = (\<Union>X\<in>A. h(X)))"
+
+lemma bnd_mono_iterates_subset: "[|bnd_mono(D, h); n \<in> nat|] ==> h^n (0) \<subseteq> D"
+apply (induct_tac n) 
+ apply (simp_all add: bnd_mono_def, blast) 
+done
+
+lemma bnd_mono_increasing [rule_format]:
+     "[|i \<in> nat; j \<in> nat; bnd_mono(D,h)|] ==> i \<le> j \<longrightarrow> h^i(0) \<subseteq> h^j(0)"
+apply (rule_tac m=i and n=j in diff_induct, simp_all)
+apply (blast del: subsetI
+             intro: bnd_mono_iterates_subset bnd_monoD2 [of concl: h]) 
+done
+
+lemma directed_iterates: "bnd_mono(D,h) ==> directed({h^n (0). n\<in>nat})"
+apply (simp add: directed_def, clarify) 
+apply (rename_tac i j)
+apply (rule_tac x="i \<union> j" in bexI) 
+apply (rule_tac i = i and j = j in Ord_linear_le)
+apply (simp_all add: subset_Un_iff [THEN iffD1] le_imp_subset
+                     subset_Un_iff2 [THEN iffD1])
+apply (simp_all add: subset_Un_iff [THEN iff_sym] bnd_mono_increasing
+                     subset_Un_iff2 [THEN iff_sym])
+done
+
+
+lemma contin_iterates_eq: 
+    "[|bnd_mono(D, h); contin(h)|] 
+     ==> h(\<Union>n\<in>nat. h^n (0)) = (\<Union>n\<in>nat. h^n (0))"
+apply (simp add: contin_def directed_iterates) 
+apply (rule trans) 
+apply (rule equalityI) 
+ apply (simp_all add: UN_subset_iff)
+ apply safe
+ apply (erule_tac [2] natE) 
+  apply (rule_tac a="succ(x)" in UN_I) 
+   apply simp_all 
+apply blast 
+done
+
+lemma lfp_subset_Union:
+     "[|bnd_mono(D, h); contin(h)|] ==> lfp(D,h) \<subseteq> (\<Union>n\<in>nat. h^n(0))"
+apply (rule lfp_lowerbound) 
+ apply (simp add: contin_iterates_eq) 
+apply (simp add: contin_def bnd_mono_iterates_subset UN_subset_iff) 
+done
+
+lemma Union_subset_lfp:
+     "bnd_mono(D,h) ==> (\<Union>n\<in>nat. h^n(0)) \<subseteq> lfp(D,h)"
+apply (simp add: UN_subset_iff)
+apply (rule ballI)  
+apply (induct_tac n, simp_all) 
+apply (rule subset_trans [of _ "h(lfp(D,h))"])
+ apply (blast dest: bnd_monoD2 [OF _ _ lfp_subset])  
+apply (erule lfp_lemma2) 
+done
+
+lemma lfp_eq_Union:
+     "[|bnd_mono(D, h); contin(h)|] ==> lfp(D,h) = (\<Union>n\<in>nat. h^n(0))"
+by (blast del: subsetI 
+          intro: lfp_subset_Union Union_subset_lfp)
+
+
+subsubsection\<open>Some Standard Datatype Constructions Preserve Continuity\<close>
+
+lemma contin_imp_mono: "[|X\<subseteq>Y; contin(F)|] ==> F(X) \<subseteq> F(Y)"
+apply (simp add: contin_def) 
+apply (drule_tac x="{X,Y}" in spec) 
+apply (simp add: directed_def subset_Un_iff2 Un_commute) 
+done
+
+lemma sum_contin: "[|contin(F); contin(G)|] ==> contin(\<lambda>X. F(X) + G(X))"
+by (simp add: contin_def, blast)
+
+lemma prod_contin: "[|contin(F); contin(G)|] ==> contin(\<lambda>X. F(X) * G(X))" 
+apply (subgoal_tac "\<forall>B C. F(B) \<subseteq> F(B \<union> C)")
+ prefer 2 apply (simp add: Un_upper1 contin_imp_mono) 
+apply (subgoal_tac "\<forall>B C. G(C) \<subseteq> G(B \<union> C)")
+ prefer 2 apply (simp add: Un_upper2 contin_imp_mono) 
+apply (simp add: contin_def, clarify) 
+apply (rule equalityI) 
+ prefer 2 apply blast 
+apply clarify 
+apply (rename_tac B C) 
+apply (rule_tac a="B \<union> C" in UN_I) 
+ apply (simp add: directed_def, blast)  
+done
+
+lemma const_contin: "contin(\<lambda>X. A)"
+by (simp add: contin_def directed_def)
+
+lemma id_contin: "contin(\<lambda>X. X)"
+by (simp add: contin_def)
+
+
+
+subsection \<open>Absoluteness for "Iterates"\<close>
+
+definition
+  iterates_MH :: "[i=>o, [i,i]=>o, i, i, i, i] => o" where
+   "iterates_MH(M,isF,v,n,g,z) ==
+        is_nat_case(M, v, \<lambda>m u. \<exists>gm[M]. fun_apply(M,g,m,gm) & isF(gm,u),
+                    n, z)"
+
+definition
+  is_iterates :: "[i=>o, [i,i]=>o, i, i, i] => o" where
+    "is_iterates(M,isF,v,n,Z) == 
+      \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) & membership(M,sn,msn) &
+                       is_wfrec(M, iterates_MH(M,isF,v), msn, n, Z)"
+
+definition
+  iterates_replacement :: "[i=>o, [i,i]=>o, i] => o" where
+   "iterates_replacement(M,isF,v) ==
+      \<forall>n[M]. n\<in>nat \<longrightarrow> 
+         wfrec_replacement(M, iterates_MH(M,isF,v), Memrel(succ(n)))"
+
+lemma (in M_basic) iterates_MH_abs:
+  "[| relation1(M,isF,F); M(n); M(g); M(z) |] 
+   ==> iterates_MH(M,isF,v,n,g,z) \<longleftrightarrow> z = nat_case(v, \<lambda>m. F(g`m), n)"
+by (simp add: nat_case_abs [of _ "\<lambda>m. F(g ` m)"]
+              relation1_def iterates_MH_def)  
+
+lemma (in M_trancl) iterates_imp_wfrec_replacement:
+  "[|relation1(M,isF,F); n \<in> nat; iterates_replacement(M,isF,v)|] 
+   ==> wfrec_replacement(M, \<lambda>n f z. z = nat_case(v, \<lambda>m. F(f`m), n), 
+                       Memrel(succ(n)))" 
+by (simp add: iterates_replacement_def iterates_MH_abs)
+
+theorem (in M_trancl) iterates_abs:
+  "[| iterates_replacement(M,isF,v); relation1(M,isF,F);
+      n \<in> nat; M(v); M(z); \<forall>x[M]. M(F(x)) |] 
+   ==> is_iterates(M,isF,v,n,z) \<longleftrightarrow> z = iterates(F,n,v)" 
+apply (frule iterates_imp_wfrec_replacement, assumption+)
+apply (simp add: wf_Memrel trans_Memrel relation_Memrel 
+                 is_iterates_def relation2_def iterates_MH_abs 
+                 iterates_nat_def recursor_def transrec_def 
+                 eclose_sing_Ord_eq nat_into_M
+         trans_wfrec_abs [of _ _ _ _ "\<lambda>n g. nat_case(v, \<lambda>m. F(g`m), n)"])
+done
+
+
+lemma (in M_trancl) iterates_closed [intro,simp]:
+  "[| iterates_replacement(M,isF,v); relation1(M,isF,F);
+      n \<in> nat; M(v); \<forall>x[M]. M(F(x)) |] 
+   ==> M(iterates(F,n,v))"
+apply (frule iterates_imp_wfrec_replacement, assumption+)
+apply (simp add: wf_Memrel trans_Memrel relation_Memrel 
+                 relation2_def iterates_MH_abs 
+                 iterates_nat_def recursor_def transrec_def 
+                 eclose_sing_Ord_eq nat_into_M
+         trans_wfrec_closed [of _ _ _ "\<lambda>n g. nat_case(v, \<lambda>m. F(g`m), n)"])
+done
+
+
+subsection \<open>lists without univ\<close>
+
+lemmas datatype_univs = Inl_in_univ Inr_in_univ 
+                        Pair_in_univ nat_into_univ A_into_univ 
+
+lemma list_fun_bnd_mono: "bnd_mono(univ(A), \<lambda>X. {0} + A*X)"
+apply (rule bnd_monoI)
+ apply (intro subset_refl zero_subset_univ A_subset_univ 
+              sum_subset_univ Sigma_subset_univ) 
+apply (rule subset_refl sum_mono Sigma_mono | assumption)+
+done
+
+lemma list_fun_contin: "contin(\<lambda>X. {0} + A*X)"
+by (intro sum_contin prod_contin id_contin const_contin) 
+
+text\<open>Re-expresses lists using sum and product\<close>
+lemma list_eq_lfp2: "list(A) = lfp(univ(A), \<lambda>X. {0} + A*X)"
+apply (simp add: list_def) 
+apply (rule equalityI) 
+ apply (rule lfp_lowerbound) 
+  prefer 2 apply (rule lfp_subset)
+ apply (clarify, subst lfp_unfold [OF list_fun_bnd_mono])
+ apply (simp add: Nil_def Cons_def)
+ apply blast 
+txt\<open>Opposite inclusion\<close>
+apply (rule lfp_lowerbound) 
+ prefer 2 apply (rule lfp_subset) 
+apply (clarify, subst lfp_unfold [OF list.bnd_mono]) 
+apply (simp add: Nil_def Cons_def)
+apply (blast intro: datatype_univs
+             dest: lfp_subset [THEN subsetD])
+done
+
+text\<open>Re-expresses lists using "iterates", no univ.\<close>
+lemma list_eq_Union:
+     "list(A) = (\<Union>n\<in>nat. (\<lambda>X. {0} + A*X) ^ n (0))"
+by (simp add: list_eq_lfp2 lfp_eq_Union list_fun_bnd_mono list_fun_contin)
+
+
+definition
+  is_list_functor :: "[i=>o,i,i,i] => o" where
+    "is_list_functor(M,A,X,Z) == 
+        \<exists>n1[M]. \<exists>AX[M]. 
+         number1(M,n1) & cartprod(M,A,X,AX) & is_sum(M,n1,AX,Z)"
+
+lemma (in M_basic) list_functor_abs [simp]: 
+     "[| M(A); M(X); M(Z) |] ==> is_list_functor(M,A,X,Z) \<longleftrightarrow> (Z = {0} + A*X)"
+by (simp add: is_list_functor_def singleton_0 nat_into_M)
+
+
+subsection \<open>formulas without univ\<close>
+
+lemma formula_fun_bnd_mono:
+     "bnd_mono(univ(0), \<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
+apply (rule bnd_monoI)
+ apply (intro subset_refl zero_subset_univ A_subset_univ 
+              sum_subset_univ Sigma_subset_univ nat_subset_univ) 
+apply (rule subset_refl sum_mono Sigma_mono | assumption)+
+done
+
+lemma formula_fun_contin:
+     "contin(\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
+by (intro sum_contin prod_contin id_contin const_contin) 
+
+
+text\<open>Re-expresses formulas using sum and product\<close>
+lemma formula_eq_lfp2:
+    "formula = lfp(univ(0), \<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X))"
+apply (simp add: formula_def) 
+apply (rule equalityI) 
+ apply (rule lfp_lowerbound) 
+  prefer 2 apply (rule lfp_subset)
+ apply (clarify, subst lfp_unfold [OF formula_fun_bnd_mono])
+ apply (simp add: Member_def Equal_def Nand_def Forall_def)
+ apply blast 
+txt\<open>Opposite inclusion\<close>
+apply (rule lfp_lowerbound) 
+ prefer 2 apply (rule lfp_subset, clarify) 
+apply (subst lfp_unfold [OF formula.bnd_mono, simplified]) 
+apply (simp add: Member_def Equal_def Nand_def Forall_def)  
+apply (elim sumE SigmaE, simp_all) 
+apply (blast intro: datatype_univs dest: lfp_subset [THEN subsetD])+  
+done
+
+text\<open>Re-expresses formulas using "iterates", no univ.\<close>
+lemma formula_eq_Union:
+     "formula = 
+      (\<Union>n\<in>nat. (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)) ^ n (0))"
+by (simp add: formula_eq_lfp2 lfp_eq_Union formula_fun_bnd_mono 
+              formula_fun_contin)
+
+
+definition
+  is_formula_functor :: "[i=>o,i,i] => o" where
+    "is_formula_functor(M,X,Z) == 
+        \<exists>nat'[M]. \<exists>natnat[M]. \<exists>natnatsum[M]. \<exists>XX[M]. \<exists>X3[M]. 
+          omega(M,nat') & cartprod(M,nat',nat',natnat) & 
+          is_sum(M,natnat,natnat,natnatsum) &
+          cartprod(M,X,X,XX) & is_sum(M,XX,X,X3) & 
+          is_sum(M,natnatsum,X3,Z)"
+
+lemma (in M_trancl) formula_functor_abs [simp]: 
+     "[| M(X); M(Z) |] 
+      ==> is_formula_functor(M,X,Z) \<longleftrightarrow> 
+          Z = ((nat*nat) + (nat*nat)) + (X*X + X)"
+by (simp add: is_formula_functor_def) 
+
+
+subsection\<open>\<^term>\<open>M\<close> Contains the List and Formula Datatypes\<close>
+
+definition
+  list_N :: "[i,i] => i" where
+    "list_N(A,n) == (\<lambda>X. {0} + A * X)^n (0)"
+
+lemma Nil_in_list_N [simp]: "[] \<in> list_N(A,succ(n))"
+by (simp add: list_N_def Nil_def)
+
+lemma Cons_in_list_N [simp]:
+     "Cons(a,l) \<in> list_N(A,succ(n)) \<longleftrightarrow> a\<in>A & l \<in> list_N(A,n)"
+by (simp add: list_N_def Cons_def) 
+
+text\<open>These two aren't simprules because they reveal the underlying
+list representation.\<close>
+lemma list_N_0: "list_N(A,0) = 0"
+by (simp add: list_N_def)
+
+lemma list_N_succ: "list_N(A,succ(n)) = {0} + A * (list_N(A,n))"
+by (simp add: list_N_def)
+
+lemma list_N_imp_list:
+  "[| l \<in> list_N(A,n); n \<in> nat |] ==> l \<in> list(A)"
+by (force simp add: list_eq_Union list_N_def)
+
+lemma list_N_imp_length_lt [rule_format]:
+     "n \<in> nat ==> \<forall>l \<in> list_N(A,n). length(l) < n"
+apply (induct_tac n)  
+apply (auto simp add: list_N_0 list_N_succ 
+                      Nil_def [symmetric] Cons_def [symmetric]) 
+done
+
+lemma list_imp_list_N [rule_format]:
+     "l \<in> list(A) ==> \<forall>n\<in>nat. length(l) < n \<longrightarrow> l \<in> list_N(A, n)"
+apply (induct_tac l)
+apply (force elim: natE)+
+done
+
+lemma list_N_imp_eq_length:
+      "[|n \<in> nat; l \<notin> list_N(A, n); l \<in> list_N(A, succ(n))|] 
+       ==> n = length(l)"
+apply (rule le_anti_sym) 
+ prefer 2 apply (simp add: list_N_imp_length_lt) 
+apply (frule list_N_imp_list, simp)
+apply (simp add: not_lt_iff_le [symmetric]) 
+apply (blast intro: list_imp_list_N) 
+done
+  
+text\<open>Express \<^term>\<open>list_rec\<close> without using \<^term>\<open>rank\<close> or \<^term>\<open>Vset\<close>,
+neither of which is absolute.\<close>
+lemma (in M_trivial) list_rec_eq:
+  "l \<in> list(A) ==>
+   list_rec(a,g,l) = 
+   transrec (succ(length(l)),
+      \<lambda>x h. Lambda (list(A),
+                    list_case' (a, 
+                           \<lambda>a l. g(a, l, h ` succ(length(l)) ` l)))) ` l"
+apply (induct_tac l) 
+apply (subst transrec, simp) 
+apply (subst transrec) 
+apply (simp add: list_imp_list_N) 
+done
+
+definition
+  is_list_N :: "[i=>o,i,i,i] => o" where
+    "is_list_N(M,A,n,Z) == 
+      \<exists>zero[M]. empty(M,zero) & 
+                is_iterates(M, is_list_functor(M,A), zero, n, Z)"
+
+definition  
+  mem_list :: "[i=>o,i,i] => o" where
+    "mem_list(M,A,l) == 
+      \<exists>n[M]. \<exists>listn[M]. 
+       finite_ordinal(M,n) & is_list_N(M,A,n,listn) & l \<in> listn"
+
+definition
+  is_list :: "[i=>o,i,i] => o" where
+    "is_list(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_list(M,A,l)"
+
+subsubsection\<open>Towards Absoluteness of \<^term>\<open>formula_rec\<close>\<close>
+
+consts   depth :: "i=>i"
+primrec
+  "depth(Member(x,y)) = 0"
+  "depth(Equal(x,y))  = 0"
+  "depth(Nand(p,q)) = succ(depth(p) \<union> depth(q))"
+  "depth(Forall(p)) = succ(depth(p))"
+
+lemma depth_type [TC]: "p \<in> formula ==> depth(p) \<in> nat"
+by (induct_tac p, simp_all) 
+
+
+definition
+  formula_N :: "i => i" where
+    "formula_N(n) == (\<lambda>X. ((nat*nat) + (nat*nat)) + (X*X + X)) ^ n (0)"
+
+lemma Member_in_formula_N [simp]:
+     "Member(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> nat & y \<in> nat"
+by (simp add: formula_N_def Member_def) 
+
+lemma Equal_in_formula_N [simp]:
+     "Equal(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> nat & y \<in> nat"
+by (simp add: formula_N_def Equal_def) 
+
+lemma Nand_in_formula_N [simp]:
+     "Nand(x,y) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> formula_N(n) & y \<in> formula_N(n)"
+by (simp add: formula_N_def Nand_def) 
+
+lemma Forall_in_formula_N [simp]:
+     "Forall(x) \<in> formula_N(succ(n)) \<longleftrightarrow> x \<in> formula_N(n)"
+by (simp add: formula_N_def Forall_def) 
+
+text\<open>These two aren't simprules because they reveal the underlying
+formula representation.\<close>
+lemma formula_N_0: "formula_N(0) = 0"
+by (simp add: formula_N_def)
+
+lemma formula_N_succ:
+     "formula_N(succ(n)) = 
+      ((nat*nat) + (nat*nat)) + (formula_N(n) * formula_N(n) + formula_N(n))"
+by (simp add: formula_N_def)
+
+lemma formula_N_imp_formula:
+  "[| p \<in> formula_N(n); n \<in> nat |] ==> p \<in> formula"
+by (force simp add: formula_eq_Union formula_N_def)
+
+lemma formula_N_imp_depth_lt [rule_format]:
+     "n \<in> nat ==> \<forall>p \<in> formula_N(n). depth(p) < n"
+apply (induct_tac n)  
+apply (auto simp add: formula_N_0 formula_N_succ 
+                      depth_type formula_N_imp_formula Un_least_lt_iff
+                      Member_def [symmetric] Equal_def [symmetric]
+                      Nand_def [symmetric] Forall_def [symmetric]) 
+done
+
+lemma formula_imp_formula_N [rule_format]:
+     "p \<in> formula ==> \<forall>n\<in>nat. depth(p) < n \<longrightarrow> p \<in> formula_N(n)"
+apply (induct_tac p)
+apply (simp_all add: succ_Un_distrib Un_least_lt_iff) 
+apply (force elim: natE)+
+done
+
+lemma formula_N_imp_eq_depth:
+      "[|n \<in> nat; p \<notin> formula_N(n); p \<in> formula_N(succ(n))|] 
+       ==> n = depth(p)"
+apply (rule le_anti_sym) 
+ prefer 2 apply (simp add: formula_N_imp_depth_lt) 
+apply (frule formula_N_imp_formula, simp)
+apply (simp add: not_lt_iff_le [symmetric]) 
+apply (blast intro: formula_imp_formula_N) 
+done
+
+
+text\<open>This result and the next are unused.\<close>
+lemma formula_N_mono [rule_format]:
+  "[| m \<in> nat; n \<in> nat |] ==> m\<le>n \<longrightarrow> formula_N(m) \<subseteq> formula_N(n)"
+apply (rule_tac m = m and n = n in diff_induct)
+apply (simp_all add: formula_N_0 formula_N_succ, blast) 
+done
+
+lemma formula_N_distrib:
+  "[| m \<in> nat; n \<in> nat |] ==> formula_N(m \<union> n) = formula_N(m) \<union> formula_N(n)"
+apply (rule_tac i = m and j = n in Ord_linear_le, auto) 
+apply (simp_all add: subset_Un_iff [THEN iffD1] subset_Un_iff2 [THEN iffD1] 
+                     le_imp_subset formula_N_mono)
+done
+
+definition
+  is_formula_N :: "[i=>o,i,i] => o" where
+    "is_formula_N(M,n,Z) == 
+      \<exists>zero[M]. empty(M,zero) & 
+                is_iterates(M, is_formula_functor(M), zero, n, Z)"
+
+
+definition  
+  mem_formula :: "[i=>o,i] => o" where
+    "mem_formula(M,p) == 
+      \<exists>n[M]. \<exists>formn[M]. 
+       finite_ordinal(M,n) & is_formula_N(M,n,formn) & p \<in> formn"
+
+definition
+  is_formula :: "[i=>o,i] => o" where
+    "is_formula(M,Z) == \<forall>p[M]. p \<in> Z \<longleftrightarrow> mem_formula(M,p)"
+
+subsubsection\<open>Absoluteness of the List Construction\<close>
+
+
+subsubsection\<open>Absoluteness of Formulas\<close>
+
+
+subsection\<open>Absoluteness for \<open>\<epsilon>\<close>-Closure: the \<^term>\<open>eclose\<close> Operator\<close>
+
+text\<open>Re-expresses eclose using "iterates"\<close>
+lemma eclose_eq_Union:
+     "eclose(A) = (\<Union>n\<in>nat. Union^n (A))"
+apply (simp add: eclose_def)
+apply (rule UN_cong)
+apply (rule refl)
+apply (induct_tac n)
+apply (simp add: nat_rec_0)
+apply (simp add: nat_rec_succ)
+done
+
+definition
+  is_eclose_n :: "[i=>o,i,i,i] => o" where
+    "is_eclose_n(M,A,n,Z) == is_iterates(M, big_union(M), A, n, Z)"
+
+definition
+  mem_eclose :: "[i=>o,i,i] => o" where
+    "mem_eclose(M,A,l) ==
+      \<exists>n[M]. \<exists>eclosen[M].
+       finite_ordinal(M,n) & is_eclose_n(M,A,n,eclosen) & l \<in> eclosen"
+
+definition
+  is_eclose :: "[i=>o,i,i] => o" where
+    "is_eclose(M,A,Z) == \<forall>u[M]. u \<in> Z \<longleftrightarrow> mem_eclose(M,A,u)"
+
+
+locale M_eclose = M_trancl +
+ assumes eclose_replacement1:
+   "M(A) ==> iterates_replacement(M, big_union(M), A)"
+  and eclose_replacement2:
+   "M(A) ==> strong_replacement(M,
+         \<lambda>n y. n\<in>nat & is_iterates(M, big_union(M), A, n, y))"
+
+lemma (in M_eclose) eclose_replacement2':
+  "M(A) ==> strong_replacement(M, \<lambda>n y. n\<in>nat & y = Union^n (A))"
+apply (insert eclose_replacement2 [of A])
+apply (rule strong_replacement_cong [THEN iffD1])
+apply (rule conj_cong [OF iff_refl iterates_abs [of "big_union(M)"]])
+apply (simp_all add: eclose_replacement1 relation1_def)
+done
+
+lemma (in M_eclose) eclose_closed [intro,simp]:
+     "M(A) ==> M(eclose(A))"
+apply (insert eclose_replacement1)
+by  (simp add: RepFun_closed2 eclose_eq_Union
+               eclose_replacement2' relation1_def
+               iterates_closed [of "big_union(M)"])
+
+lemma (in M_eclose) is_eclose_n_abs [simp]:
+     "[|M(A); n\<in>nat; M(Z)|] ==> is_eclose_n(M,A,n,Z) \<longleftrightarrow> Z = Union^n (A)"
+apply (insert eclose_replacement1)
+apply (simp add: is_eclose_n_def relation1_def nat_into_M
+                 iterates_abs [of "big_union(M)" _ "Union"])
+done
+
+lemma (in M_eclose) mem_eclose_abs [simp]:
+     "M(A) ==> mem_eclose(M,A,l) \<longleftrightarrow> l \<in> eclose(A)"
+apply (insert eclose_replacement1)
+apply (simp add: mem_eclose_def relation1_def eclose_eq_Union
+                 iterates_closed [of "big_union(M)"])
+done
+
+lemma (in M_eclose) eclose_abs [simp]:
+     "[|M(A); M(Z)|] ==> is_eclose(M,A,Z) \<longleftrightarrow> Z = eclose(A)"
+apply (simp add: is_eclose_def, safe)
+apply (rule M_equalityI, simp_all)
+done
+
+
+subsection \<open>Absoluteness for \<^term>\<open>transrec\<close>\<close>
+
+text\<open>\<^prop>\<open>transrec(a,H) \<equiv> wfrec(Memrel(eclose({a})), a, H)\<close>\<close>
+
+definition
+  is_transrec :: "[i=>o, [i,i,i]=>o, i, i] => o" where
+   "is_transrec(M,MH,a,z) ==
+      \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M].
+       upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
+       is_wfrec(M,MH,mesa,a,z)"
+
+definition
+  transrec_replacement :: "[i=>o, [i,i,i]=>o, i] => o" where
+   "transrec_replacement(M,MH,a) ==
+      \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M].
+       upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
+       wfrec_replacement(M,MH,mesa)"
+
+text\<open>The condition \<^term>\<open>Ord(i)\<close> lets us use the simpler
+  \<open>trans_wfrec_abs\<close> rather than \<open>trans_wfrec_abs\<close>,
+  which I haven't even proved yet.\<close>
+theorem (in M_eclose) transrec_abs:
+  "[|transrec_replacement(M,MH,i);  relation2(M,MH,H);
+     Ord(i);  M(i);  M(z);
+     \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|]
+   ==> is_transrec(M,MH,i,z) \<longleftrightarrow> z = transrec(i,H)"
+by (simp add: trans_wfrec_abs transrec_replacement_def is_transrec_def
+       transrec_def eclose_sing_Ord_eq wf_Memrel trans_Memrel relation_Memrel)
+
+
+theorem (in M_eclose) transrec_closed:
+     "[|transrec_replacement(M,MH,i);  relation2(M,MH,H);
+        Ord(i);  M(i);
+        \<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(H(x,g))|]
+      ==> M(transrec(i,H))"
+by (simp add: trans_wfrec_closed transrec_replacement_def is_transrec_def
+        transrec_def eclose_sing_Ord_eq wf_Memrel trans_Memrel relation_Memrel)
+
+
+text\<open>Helps to prove instances of \<^term>\<open>transrec_replacement\<close>\<close>
+lemma (in M_eclose) transrec_replacementI:
+   "[|M(a);
+      strong_replacement (M,
+                  \<lambda>x z. \<exists>y[M]. pair(M, x, y, z) &
+                               is_wfrec(M,MH,Memrel(eclose({a})),x,y))|]
+    ==> transrec_replacement(M,MH,a)"
+by (simp add: transrec_replacement_def wfrec_replacement_def)
+
+
+subsection\<open>Absoluteness for the List Operator \<^term>\<open>length\<close>\<close>
+text\<open>But it is never used.\<close>
+
+definition
+  is_length :: "[i=>o,i,i,i] => o" where
+    "is_length(M,A,l,n) ==
+       \<exists>sn[M]. \<exists>list_n[M]. \<exists>list_sn[M].
+        is_list_N(M,A,n,list_n) & l \<notin> list_n &
+        successor(M,n,sn) & is_list_N(M,A,sn,list_sn) & l \<in> list_sn"
+
+
+text\<open>Proof is trivial since \<^term>\<open>length\<close> returns natural numbers.\<close>
+lemma (in M_trivial) length_closed [intro,simp]:
+     "l \<in> list(A) ==> M(length(l))"
+by (simp add: nat_into_M)
+
+
+subsection \<open>Absoluteness for the List Operator \<^term>\<open>nth\<close>\<close>
+
+lemma nth_eq_hd_iterates_tl [rule_format]:
+     "xs \<in> list(A) ==> \<forall>n \<in> nat. nth(n,xs) = hd' (tl'^n (xs))"
+apply (induct_tac xs)
+apply (simp add: iterates_tl_Nil hd'_Nil, clarify)
+apply (erule natE)
+apply (simp add: hd'_Cons)
+apply (simp add: tl'_Cons iterates_commute)
+done
+
+lemma (in M_basic) iterates_tl'_closed:
+     "[|n \<in> nat; M(x)|] ==> M(tl'^n (x))"
+apply (induct_tac n, simp)
+apply (simp add: tl'_Cons tl'_closed)
+done
+
+text\<open>Immediate by type-checking\<close>
+lemma (in M_trancl) nth_closed [intro,simp]:
+     "[|xs \<in> list(A); n \<in> nat; M(A)|] ==> M(nth(n,xs))"
+apply (case_tac "n < length(xs)")
+ apply (blast intro: nth_type transM)
+apply (simp add: not_lt_iff_le nth_eq_0)
+done
+
+subsection\<open>Relativization and Absoluteness for the \<^term>\<open>formula\<close> Constructors\<close>
+
+definition
+  is_Member :: "[i=>o,i,i,i] => o" where
+     \<comment> \<open>because \<^term>\<open>Member(x,y) \<equiv> Inl(Inl(\<langle>x,y\<rangle>))\<close>\<close>
+    "is_Member(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inl(M,u,Z)"
+
+lemma (in M_trivial) Member_abs [simp]:
+     "[|M(x); M(y); M(Z)|] ==> is_Member(M,x,y,Z) \<longleftrightarrow> (Z = Member(x,y))"
+by (simp add: is_Member_def Member_def)
+
+lemma (in M_trivial) Member_in_M_iff [iff]:
+     "M(Member(x,y)) \<longleftrightarrow> M(x) & M(y)"
+by (simp add: Member_def)
+
+definition
+  is_Equal :: "[i=>o,i,i,i] => o" where
+     \<comment> \<open>because \<^term>\<open>Equal(x,y) \<equiv> Inl(Inr(\<langle>x,y\<rangle>))\<close>\<close>
+    "is_Equal(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inr(M,p,u) & is_Inl(M,u,Z)"
+
+lemma (in M_trivial) Equal_abs [simp]:
+     "[|M(x); M(y); M(Z)|] ==> is_Equal(M,x,y,Z) \<longleftrightarrow> (Z = Equal(x,y))"
+by (simp add: is_Equal_def Equal_def)
+
+lemma (in M_trivial) Equal_in_M_iff [iff]: "M(Equal(x,y)) \<longleftrightarrow> M(x) & M(y)"
+by (simp add: Equal_def)
+
+definition
+  is_Nand :: "[i=>o,i,i,i] => o" where
+     \<comment> \<open>because \<^term>\<open>Nand(x,y) \<equiv> Inr(Inl(\<langle>x,y\<rangle>))\<close>\<close>
+    "is_Nand(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inr(M,u,Z)"
+
+lemma (in M_trivial) Nand_abs [simp]:
+     "[|M(x); M(y); M(Z)|] ==> is_Nand(M,x,y,Z) \<longleftrightarrow> (Z = Nand(x,y))"
+by (simp add: is_Nand_def Nand_def)
+
+lemma (in M_trivial) Nand_in_M_iff [iff]: "M(Nand(x,y)) \<longleftrightarrow> M(x) & M(y)"
+by (simp add: Nand_def)
+
+definition
+  is_Forall :: "[i=>o,i,i] => o" where
+     \<comment> \<open>because \<^term>\<open>Forall(x) \<equiv> Inr(Inr(p))\<close>\<close>
+    "is_Forall(M,p,Z) == \<exists>u[M]. is_Inr(M,p,u) & is_Inr(M,u,Z)"
+
+lemma (in M_trivial) Forall_abs [simp]:
+     "[|M(x); M(Z)|] ==> is_Forall(M,x,Z) \<longleftrightarrow> (Z = Forall(x))"
+by (simp add: is_Forall_def Forall_def)
+
+lemma (in M_trivial) Forall_in_M_iff [iff]: "M(Forall(x)) \<longleftrightarrow> M(x)"
+by (simp add: Forall_def)
+
+
+
+subsection \<open>Absoluteness for \<^term>\<open>formula_rec\<close>\<close>
+
+definition
+  formula_rec_case :: "[[i,i]=>i, [i,i]=>i, [i,i,i,i]=>i, [i,i]=>i, i, i] => i" where
+    \<comment> \<open>the instance of \<^term>\<open>formula_case\<close> in \<^term>\<open>formula_rec\<close>\<close>
+   "formula_rec_case(a,b,c,d,h) ==
+        formula_case (a, b,
+                \<lambda>u v. c(u, v, h ` succ(depth(u)) ` u,
+                              h ` succ(depth(v)) ` v),
+                \<lambda>u. d(u, h ` succ(depth(u)) ` u))"
+
+text\<open>Unfold \<^term>\<open>formula_rec\<close> to \<^term>\<open>formula_rec_case\<close>.
+     Express \<^term>\<open>formula_rec\<close> without using \<^term>\<open>rank\<close> or \<^term>\<open>Vset\<close>,
+neither of which is absolute.\<close>
+lemma (in M_trivial) formula_rec_eq:
+  "p \<in> formula ==>
+   formula_rec(a,b,c,d,p) =
+   transrec (succ(depth(p)),
+             \<lambda>x h. Lambda (formula, formula_rec_case(a,b,c,d,h))) ` p"
+apply (simp add: formula_rec_case_def)
+apply (induct_tac p)
+   txt\<open>Base case for \<^term>\<open>Member\<close>\<close>
+   apply (subst transrec, simp add: formula.intros)
+  txt\<open>Base case for \<^term>\<open>Equal\<close>\<close>
+  apply (subst transrec, simp add: formula.intros)
+ txt\<open>Inductive step for \<^term>\<open>Nand\<close>\<close>
+ apply (subst transrec)
+ apply (simp add: succ_Un_distrib formula.intros)
+txt\<open>Inductive step for \<^term>\<open>Forall\<close>\<close>
+apply (subst transrec)
+apply (simp add: formula_imp_formula_N formula.intros)
+done
+
+
+subsubsection\<open>Absoluteness for the Formula Operator \<^term>\<open>depth\<close>\<close>
+
+definition
+  is_depth :: "[i=>o,i,i] => o" where
+    "is_depth(M,p,n) ==
+       \<exists>sn[M]. \<exists>formula_n[M]. \<exists>formula_sn[M].
+        is_formula_N(M,n,formula_n) & p \<notin> formula_n &
+        successor(M,n,sn) & is_formula_N(M,sn,formula_sn) & p \<in> formula_sn"
+
+
+
+text\<open>Proof is trivial since \<^term>\<open>depth\<close> returns natural numbers.\<close>
+lemma (in M_trivial) depth_closed [intro,simp]:
+     "p \<in> formula ==> M(depth(p))"
+by (simp add: nat_into_M)
+
+
+
+end
diff --git a/thys/Transitive_Models/Internalizations.thy b/thys/Transitive_Models/Internalizations.thy
--- a/thys/Transitive_Models/Internalizations.thy
+++ b/thys/Transitive_Models/Internalizations.thy
@@ -1,279 +1,279 @@
 section\<open>Aids to internalize formulas\<close>
 
 theory Internalizations
   imports
-    "ZF-Constructible.DPow_absolute"
+    DPow_absolute
     Synthetic_Definition
     Nat_Miscellanea
 begin
 
 hide_const (open) Order.pred
 
 definition
   infinity_ax :: "(i \<Rightarrow> o) \<Rightarrow> o" where
   "infinity_ax(M) \<equiv>
       (\<exists>I[M]. (\<exists>z[M]. empty(M,z) \<and> z\<in>I) \<and> (\<forall>y[M]. y\<in>I \<longrightarrow> (\<exists>sy[M]. successor(M,y,sy) \<and> sy\<in>I)))"
 
 definition
   wellfounded_trancl :: "[i=>o,i,i,i] => o" where
   "wellfounded_trancl(M,Z,r,p) \<equiv>
       \<exists>w[M]. \<exists>wx[M]. \<exists>rp[M].
                w \<in> Z & pair(M,w,p,wx) & tran_closure(M,r,rp) & wx \<in> rp"
 
 lemma empty_intf :
   "infinity_ax(M) \<Longrightarrow>
   (\<exists>z[M]. empty(M,z))"
   by (auto simp add: empty_def infinity_ax_def)
 
 lemma Transset_intf :
   "Transset(M) \<Longrightarrow>  y\<in>x \<Longrightarrow> x \<in> M \<Longrightarrow> y \<in> M"
   by (simp add: Transset_def,auto)
 
 definition
   choice_ax :: "(i\<Rightarrow>o) \<Rightarrow> o" where
   "choice_ax(M) \<equiv> \<forall>x[M]. \<exists>a[M]. \<exists>f[M]. ordinal(M,a) \<and> surjection(M,a,x,f)"
 
 lemma (in M_basic) choice_ax_abs :
   "choice_ax(M) \<longleftrightarrow> (\<forall>x[M]. \<exists>a[M]. \<exists>f[M]. Ord(a) \<and> f \<in> surj(a,x))"
   unfolding choice_ax_def
   by simp
 
 txt\<open>Setting up notation for internalized formulas\<close>
 
 abbreviation
   dec10  :: i   ("10") where "10 \<equiv> succ(9)"
 abbreviation
   dec11  :: i   ("11") where "11 \<equiv> succ(10)"
 abbreviation
   dec12  :: i   ("12") where "12 \<equiv> succ(11)"
 abbreviation
   dec13  :: i   ("13") where "13 \<equiv> succ(12)"
 abbreviation
   dec14  :: i   ("14") where "14 \<equiv> succ(13)"
 abbreviation
   dec15  :: i   ("15") where "15 \<equiv> succ(14)"
 abbreviation
   dec16  :: i   ("16") where "16 \<equiv> succ(15)"
 abbreviation
   dec17  :: i   ("17") where "17 \<equiv> succ(16)"
 abbreviation
   dec18  :: i   ("18") where "18 \<equiv> succ(17)"
 abbreviation
   dec19  :: i   ("19") where "19 \<equiv> succ(18)"
 abbreviation
   dec20  :: i   ("20") where "20 \<equiv> succ(19)"
 abbreviation
   dec21  :: i   ("21") where "21 \<equiv> succ(20)"
 abbreviation
   dec22  :: i   ("22") where "22 \<equiv> succ(21)"
 abbreviation
   dec23  :: i   ("23") where "23 \<equiv> succ(22)"
 abbreviation
   dec24  :: i   ("24") where "24 \<equiv> succ(23)"
 abbreviation
   dec25  :: i   ("25") where "25 \<equiv> succ(24)"
 abbreviation
   dec26  :: i   ("26") where "26 \<equiv> succ(25)"
 abbreviation
   dec27  :: i   ("27") where "27 \<equiv> succ(26)"
 abbreviation
   dec28  :: i   ("28") where "28 \<equiv> succ(27)"
 abbreviation
   dec29  :: i   ("29") where "29 \<equiv> succ(28)"
 
 notation Member (\<open>\<cdot>_ \<in>/ _\<cdot>\<close>)
 notation Equal (\<open>\<cdot>_ =/ _\<cdot>\<close>)
 notation Nand (\<open>\<cdot>\<not>'(_ \<and>/ _')\<cdot>\<close>)
 notation And (\<open>\<cdot>_ \<and>/ _\<cdot>\<close>)
 notation Or (\<open>\<cdot>_ \<or>/ _\<cdot>\<close>)
 notation Iff (\<open>\<cdot>_ \<leftrightarrow>/ _\<cdot>\<close>)
 notation Implies (\<open>\<cdot>_ \<rightarrow>/ _\<cdot>\<close>)
 notation Neg (\<open>\<cdot>\<not>_\<cdot>\<close>)
 notation Forall (\<open>'(\<cdot>\<forall>(/_)\<cdot>')\<close>)
 notation Exists (\<open>'(\<cdot>\<exists>(/_)\<cdot>')\<close>)
 
 notation subset_fm (\<open>\<cdot>_ \<subseteq>/ _\<cdot>\<close>)
 notation succ_fm (\<open>\<cdot>succ'(_') is _\<cdot>\<close>)
 notation empty_fm (\<open>\<cdot>_ is empty\<cdot>\<close>)
 notation fun_apply_fm (\<open>\<cdot>_`_ is _\<cdot>\<close>)
 notation big_union_fm (\<open>\<cdot>\<Union>_ is _\<cdot>\<close>)
 notation upair_fm (\<open>\<cdot>{_,_} is _ \<cdot>\<close>)
 notation ordinal_fm (\<open>\<cdot>_ is ordinal\<cdot>\<close>)
 
 
 notation pair_fm (\<open>\<cdot>\<langle>_,_\<rangle> is _ \<cdot>\<close>)
 notation composition_fm (\<open>\<cdot>_ \<circ> _ is _ \<cdot>\<close>)
 notation domain_fm (\<open>\<cdot>dom'(_') is _ \<cdot>\<close>)
 notation range_fm (\<open>\<cdot>ran'(_') is _ \<cdot>\<close>)
 notation union_fm (\<open>\<cdot>_ \<union> _ is _ \<cdot>\<close>)
 notation image_fm (\<open>\<cdot>_ `` _ is _ \<cdot>\<close>)
 notation pre_image_fm (\<open>\<cdot>_ -`` _ is _ \<cdot>\<close>)
 notation field_fm (\<open>\<cdot>fld'(_') is _ \<cdot>\<close>)
 notation cons_fm (\<open>\<cdot>cons'(_,_') is _ \<cdot>\<close>)
 notation number1_fm (\<open>\<cdot>_ is the number one\<cdot>\<close>)
 notation function_fm (\<open>\<cdot>_ is funct\<cdot>\<close>)
 notation relation_fm (\<open>\<cdot>_ is relat\<cdot>\<close>)
 notation restriction_fm (\<open>\<cdot>_ \<restriction> _ is _ \<cdot>\<close>)
 notation transset_fm (\<open>\<cdot>_ is transitive\<cdot>\<close>)
 notation limit_ordinal_fm (\<open>\<cdot>_ is limit\<cdot>\<close>)
 notation finite_ordinal_fm (\<open>\<cdot>_ is finite ord\<cdot>\<close>)
 notation omega_fm (\<open>\<cdot>_ is \<omega>\<cdot>\<close>)
 notation cartprod_fm (\<open>\<cdot>_ \<times> _ is _\<cdot>\<close>)
 notation Memrel_fm (\<open>\<cdot>Memrel'(_') is _\<cdot>\<close>)
 notation quasinat_fm (\<open>\<cdot>_ is qnat\<cdot>\<close>)
   (* notation rtran_closure_mem_fm (\<open>\<cdot>{_,_} is _ \<cdot>\<close>)
 notation rtran_closure_fm (\<open>\<cdot>{_,_} is _ \<cdot>\<close>)
 notation tran_closure_fm (\<open>\<cdot>_ is  \<cdot>\<close>)
 notation order_isomorphism_fm (\<open>\<cdot>{_,_} is _ \<cdot>\<close>) *)
 notation Inl_fm (\<open>\<cdot>Inl'(_') is _ \<cdot>\<close>)
 notation Inr_fm (\<open>\<cdot>Inr'(_') is _ \<cdot>\<close>)
 notation pred_set_fm (\<open>\<cdot>_-predecessors of _ are _\<cdot>\<close>)
 
 
 abbreviation
   fm_typedfun :: "[i,i,i] \<Rightarrow> i" (\<open>\<cdot>_ : _ \<rightarrow> _\<cdot>\<close>) where
   "fm_typedfun(f,A,B) \<equiv> typed_function_fm(A,B,f)"
 
 abbreviation
   fm_surjection :: "[i,i,i] \<Rightarrow> i" (\<open>\<cdot>_ surjects _ to _\<cdot>\<close>) where
   "fm_surjection(f,A,B) \<equiv> surjection_fm(A,B,f)"
 
 abbreviation
   fm_injection :: "[i,i,i] \<Rightarrow> i" (\<open>\<cdot>_ injects _ to _\<cdot>\<close>) where
   "fm_injection(f,A,B) \<equiv> injection_fm(A,B,f)"
 
 abbreviation
   fm_bijection :: "[i,i,i] \<Rightarrow> i" (\<open>\<cdot>_ bijects _ to _\<cdot>\<close>) where
   "fm_bijection(f,A,B) \<equiv> bijection_fm(A,B,f)"
 
 text\<open>We found it useful to have slightly different versions of some
 results in ZF-Constructible:\<close>
 lemma nth_closed :
   assumes "env\<in>list(A)" "0\<in>A"
   shows "nth(n,env)\<in>A"
   using assms unfolding nth_def by (induct env; simp)
 
 lemma conj_setclass_model_iff_sats [iff_sats]:
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (P \<and> (##A)(x)) \<longleftrightarrow> sats(A, p, env)"
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> ((##A)(x) \<and> P) \<longleftrightarrow> sats(A, p, env)"
   using nth_closed[of env A i]
   by auto
 
 lemma conj_mem_model_iff_sats [iff_sats]:
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (P \<and> x \<in> A) \<longleftrightarrow> sats(A, p, env)"
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (x \<in> A \<and> P) \<longleftrightarrow> sats(A, p, env)"
   using nth_closed[of env A i]
   by auto
 
 (* lemma [iff_sats]:
       "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (x \<in> A \<longleftrightarrow> P) \<longleftrightarrow> sats(A, p, env)"
       "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (P \<longleftrightarrow> x \<in> A) \<longleftrightarrow> sats(A, p, env)"
 
       "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A);
        P \<longleftrightarrow> sats(A,p,env); env \<in> list(A) |]
        ==> (x \<in> A \<longrightarrow> P) \<longleftrightarrow> sats(A, p, env)"
 
   using nth_closed[of env A i]
   by auto *)
 
 lemma mem_model_iff_sats [iff_sats]:
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A)|]
        ==> (x\<in>A) \<longleftrightarrow> sats(A, Exists(Equal(0,0)), env)"
   using nth_closed[of env A i]
   by auto
 
 lemma subset_iff_sats[iff_sats]:
   "nth(i, env) = x \<Longrightarrow> nth(j, env) = y \<Longrightarrow> i\<in>nat \<Longrightarrow> j\<in>nat \<Longrightarrow>
    env \<in> list(A) \<Longrightarrow> subset(##A, x, y) \<longleftrightarrow> sats(A, subset_fm(i, j), env)"
   using sats_subset_fm' by simp
 
 lemma not_mem_model_iff_sats [iff_sats]:
   "[| 0 \<in> A; nth(i,env) = x; env \<in> list(A)|]
        ==> (\<forall> x . x \<notin> A) \<longleftrightarrow> sats(A, Neg(Exists(Equal(0,0))), env)"
   by auto
 
 lemma top_iff_sats [iff_sats]:
   "env \<in> list(A) \<Longrightarrow> 0 \<in> A \<Longrightarrow> sats(A, Exists(Equal(0,0)), env)"
   by auto
 
 lemma prefix1_iff_sats[iff_sats]:
   assumes
     "x \<in> nat" "env \<in> list(A)" "0 \<in> A" "a \<in> A"
   shows
     "a = nth(x,env) \<longleftrightarrow> sats(A, Equal(0,x+\<^sub>\<omega>1), Cons(a,env))"
     "nth(x,env) = a \<longleftrightarrow> sats(A, Equal(x+\<^sub>\<omega>1,0), Cons(a,env))"
     "a \<in> nth(x,env) \<longleftrightarrow> sats(A, Member(0,x+\<^sub>\<omega>1), Cons(a,env))"
     "nth(x,env) \<in> a \<longleftrightarrow> sats(A, Member(x+\<^sub>\<omega>1,0), Cons(a,env))"
   using assms nth_closed
   by simp_all
 
 lemma prefix2_iff_sats[iff_sats]:
   assumes
     "x \<in> nat" "env \<in> list(A)" "0 \<in> A" "a \<in> A" "b \<in> A"
   shows
     "b = nth(x,env) \<longleftrightarrow> sats(A, Equal(1,x+\<^sub>\<omega>2), Cons(a,Cons(b,env)))"
     "nth(x,env) = b \<longleftrightarrow> sats(A, Equal(x+\<^sub>\<omega>2,1), Cons(a,Cons(b,env)))"
     "b \<in> nth(x,env) \<longleftrightarrow> sats(A, Member(1,x+\<^sub>\<omega>2), Cons(a,Cons(b,env)))"
     "nth(x,env) \<in> b \<longleftrightarrow> sats(A, Member(x+\<^sub>\<omega>2,1), Cons(a,Cons(b,env)))"
   using assms nth_closed
   by simp_all
 
 lemma prefix3_iff_sats[iff_sats]:
   assumes
     "x \<in> nat" "env \<in> list(A)" "0 \<in> A" "a \<in> A" "b \<in> A" "c \<in> A"
   shows
     "c = nth(x,env) \<longleftrightarrow> sats(A, Equal(2,x+\<^sub>\<omega>3), Cons(a,Cons(b,Cons(c,env))))"
     "nth(x,env) = c \<longleftrightarrow> sats(A, Equal(x+\<^sub>\<omega>3,2), Cons(a,Cons(b,Cons(c,env))))"
     "c \<in> nth(x,env) \<longleftrightarrow> sats(A, Member(2,x+\<^sub>\<omega>3), Cons(a,Cons(b,Cons(c,env))))"
     "nth(x,env) \<in> c \<longleftrightarrow> sats(A, Member(x+\<^sub>\<omega>3,2), Cons(a,Cons(b,Cons(c,env))))"
   using assms nth_closed
   by simp_all
 
 lemmas FOL_sats_iff = sats_Nand_iff sats_Forall_iff sats_Neg_iff sats_And_iff
   sats_Or_iff sats_Implies_iff sats_Iff_iff sats_Exists_iff
 
 lemma nth_ConsI: "\<lbrakk>nth(n,l) = x; n \<in> nat\<rbrakk> \<Longrightarrow> nth(succ(n), Cons(a,l)) = x"
   by simp
 
 lemmas nth_rules = nth_0 nth_ConsI nat_0I nat_succI
 lemmas sep_rules = nth_0 nth_ConsI FOL_iff_sats function_iff_sats
   fun_plus_iff_sats successor_iff_sats
   omega_iff_sats FOL_sats_iff Replace_iff_sats
 
 text\<open>Also a different compilation of lemmas (term\<open>sep_rules\<close>) used in formula
  synthesis\<close>
 lemmas fm_defs =
   omega_fm_def limit_ordinal_fm_def empty_fm_def typed_function_fm_def
   pair_fm_def upair_fm_def domain_fm_def function_fm_def succ_fm_def
   cons_fm_def fun_apply_fm_def image_fm_def big_union_fm_def union_fm_def
   relation_fm_def composition_fm_def field_fm_def ordinal_fm_def range_fm_def
   transset_fm_def subset_fm_def Replace_fm_def
 
 lemmas formulas_def [fm_definitions] = fm_defs
   is_iterates_fm_def iterates_MH_fm_def is_wfrec_fm_def is_recfun_fm_def is_transrec_fm_def
   is_nat_case_fm_def quasinat_fm_def number1_fm_def ordinal_fm_def finite_ordinal_fm_def
   cartprod_fm_def sum_fm_def Inr_fm_def Inl_fm_def
   formula_functor_fm_def
   Memrel_fm_def transset_fm_def subset_fm_def pre_image_fm_def restriction_fm_def
   list_functor_fm_def tl_fm_def quasilist_fm_def Cons_fm_def Nil_fm_def
 
 lemmas sep_rules' [iff_sats]  = nth_0 nth_ConsI FOL_iff_sats function_iff_sats
   fun_plus_iff_sats omega_iff_sats
 
 lemmas  more_iff_sats [iff_sats] = rtran_closure_iff_sats tran_closure_iff_sats
   is_eclose_iff_sats Inl_iff_sats Inr_iff_sats fun_apply_iff_sats cartprod_iff_sats
   Collect_iff_sats
 
 end
\ No newline at end of file
diff --git a/thys/Transitive_Models/Internalize.thy b/thys/Transitive_Models/Internalize.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/Internalize.thy
@@ -0,0 +1,1483 @@
+(*  Title:      ZF/Constructible/Internalize.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+theory Internalize imports "ZF-Constructible.L_axioms" Eclose_Absolute begin
+
+subsection\<open>Internalized Forms of Data Structuring Operators\<close>
+
+subsubsection\<open>The Formula \<^term>\<open>is_Inl\<close>, Internalized\<close>
+
+(*  is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z) *)
+definition
+  Inl_fm :: "[i,i]=>i" where
+    "Inl_fm(a,z) == Exists(And(empty_fm(0), pair_fm(0,succ(a),succ(z))))"
+
+lemma Inl_type [TC]:
+     "[| x \<in> nat; z \<in> nat |] ==> Inl_fm(x,z) \<in> formula"
+by (simp add: Inl_fm_def)
+
+lemma sats_Inl_fm [simp]:
+   "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Inl_fm(x,z), env) \<longleftrightarrow> is_Inl(##A, nth(x,env), nth(z,env))"
+by (simp add: Inl_fm_def is_Inl_def)
+
+lemma Inl_iff_sats:
+      "[| nth(i,env) = x; nth(k,env) = z;
+          i \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_Inl(##A, x, z) \<longleftrightarrow> sats(A, Inl_fm(i,k), env)"
+by simp
+
+theorem Inl_reflection:
+     "REFLECTS[\<lambda>x. is_Inl(L,f(x),h(x)),
+               \<lambda>i x. is_Inl(##Lset(i),f(x),h(x))]"
+apply (simp only: is_Inl_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_Inr\<close>, Internalized\<close>
+
+(*  is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z) *)
+definition
+  Inr_fm :: "[i,i]=>i" where
+    "Inr_fm(a,z) == Exists(And(number1_fm(0), pair_fm(0,succ(a),succ(z))))"
+
+lemma Inr_type [TC]:
+     "[| x \<in> nat; z \<in> nat |] ==> Inr_fm(x,z) \<in> formula"
+by (simp add: Inr_fm_def)
+
+lemma sats_Inr_fm [simp]:
+   "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Inr_fm(x,z), env) \<longleftrightarrow> is_Inr(##A, nth(x,env), nth(z,env))"
+by (simp add: Inr_fm_def is_Inr_def)
+
+lemma Inr_iff_sats:
+      "[| nth(i,env) = x; nth(k,env) = z;
+          i \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_Inr(##A, x, z) \<longleftrightarrow> sats(A, Inr_fm(i,k), env)"
+by simp
+
+theorem Inr_reflection:
+     "REFLECTS[\<lambda>x. is_Inr(L,f(x),h(x)),
+               \<lambda>i x. is_Inr(##Lset(i),f(x),h(x))]"
+apply (simp only: is_Inr_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_Nil\<close>, Internalized\<close>
+
+(* is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs) *)
+
+definition
+  Nil_fm :: "i=>i" where
+    "Nil_fm(x) == Exists(And(empty_fm(0), Inl_fm(0,succ(x))))"
+
+lemma Nil_type [TC]: "x \<in> nat ==> Nil_fm(x) \<in> formula"
+by (simp add: Nil_fm_def)
+
+lemma sats_Nil_fm [simp]:
+   "[| x \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Nil_fm(x), env) \<longleftrightarrow> is_Nil(##A, nth(x,env))"
+by (simp add: Nil_fm_def is_Nil_def)
+
+lemma Nil_iff_sats:
+      "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
+       ==> is_Nil(##A, x) \<longleftrightarrow> sats(A, Nil_fm(i), env)"
+by simp
+
+theorem Nil_reflection:
+     "REFLECTS[\<lambda>x. is_Nil(L,f(x)),
+               \<lambda>i x. is_Nil(##Lset(i),f(x))]"
+apply (simp only: is_Nil_def)
+apply (intro FOL_reflections function_reflections Inl_reflection)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_Cons\<close>, Internalized\<close>
+
+
+(*  "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)" *)
+definition
+  Cons_fm :: "[i,i,i]=>i" where
+    "Cons_fm(a,l,Z) ==
+       Exists(And(pair_fm(succ(a),succ(l),0), Inr_fm(0,succ(Z))))"
+
+lemma Cons_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Cons_fm(x,y,z) \<in> formula"
+by (simp add: Cons_fm_def)
+
+lemma sats_Cons_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Cons_fm(x,y,z), env) \<longleftrightarrow>
+       is_Cons(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: Cons_fm_def is_Cons_def)
+
+lemma Cons_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==>is_Cons(##A, x, y, z) \<longleftrightarrow> sats(A, Cons_fm(i,j,k), env)"
+by simp
+
+theorem Cons_reflection:
+     "REFLECTS[\<lambda>x. is_Cons(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_Cons(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_Cons_def)
+apply (intro FOL_reflections pair_reflection Inr_reflection)
+done
+
+subsubsection\<open>The Formula \<^term>\<open>is_quasilist\<close>, Internalized\<close>
+
+(* is_quasilist(M,xs) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))" *)
+
+definition
+  quasilist_fm :: "i=>i" where
+    "quasilist_fm(x) ==
+       Or(Nil_fm(x), Exists(Exists(Cons_fm(1,0,succ(succ(x))))))"
+
+lemma quasilist_type [TC]: "x \<in> nat ==> quasilist_fm(x) \<in> formula"
+by (simp add: quasilist_fm_def)
+
+lemma sats_quasilist_fm [simp]:
+   "[| x \<in> nat; env \<in> list(A)|]
+    ==> sats(A, quasilist_fm(x), env) \<longleftrightarrow> is_quasilist(##A, nth(x,env))"
+by (simp add: quasilist_fm_def is_quasilist_def)
+
+lemma quasilist_iff_sats:
+      "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
+       ==> is_quasilist(##A, x) \<longleftrightarrow> sats(A, quasilist_fm(i), env)"
+by simp
+
+theorem quasilist_reflection:
+     "REFLECTS[\<lambda>x. is_quasilist(L,f(x)),
+               \<lambda>i x. is_quasilist(##Lset(i),f(x))]"
+apply (simp only: is_quasilist_def)
+apply (intro FOL_reflections Nil_reflection Cons_reflection)
+done
+
+
+subsection\<open>Absoluteness for the Function \<^term>\<open>nth\<close>\<close>
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_hd\<close>, Internalized\<close>
+
+(*   "is_hd(M,xs,H) == 
+       (is_Nil(M,xs) \<longrightarrow> empty(M,H)) &
+       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
+       (is_quasilist(M,xs) | empty(M,H))" *)
+definition
+  hd_fm :: "[i,i]=>i" where
+    "hd_fm(xs,H) == 
+       And(Implies(Nil_fm(xs), empty_fm(H)),
+           And(Forall(Forall(Or(Neg(Cons_fm(1,0,xs#+2)), Equal(H#+2,1)))),
+               Or(quasilist_fm(xs), empty_fm(H))))"
+
+lemma hd_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> hd_fm(x,y) \<in> formula"
+by (simp add: hd_fm_def) 
+
+lemma sats_hd_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, hd_fm(x,y), env) \<longleftrightarrow> is_hd(##A, nth(x,env), nth(y,env))"
+by (simp add: hd_fm_def is_hd_def)
+
+lemma hd_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_hd(##A, x, y) \<longleftrightarrow> sats(A, hd_fm(i,j), env)"
+by simp
+
+theorem hd_reflection:
+     "REFLECTS[\<lambda>x. is_hd(L,f(x),g(x)), 
+               \<lambda>i x. is_hd(##Lset(i),f(x),g(x))]"
+apply (simp only: is_hd_def)
+apply (intro FOL_reflections Nil_reflection Cons_reflection
+             quasilist_reflection empty_reflection)  
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_tl\<close>, Internalized\<close>
+
+(*     "is_tl(M,xs,T) ==
+       (is_Nil(M,xs) \<longrightarrow> T=xs) &
+       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
+       (is_quasilist(M,xs) | empty(M,T))" *)
+definition
+  tl_fm :: "[i,i]=>i" where
+    "tl_fm(xs,T) ==
+       And(Implies(Nil_fm(xs), Equal(T,xs)),
+           And(Forall(Forall(Or(Neg(Cons_fm(1,0,xs#+2)), Equal(T#+2,0)))),
+               Or(quasilist_fm(xs), empty_fm(T))))"
+
+lemma tl_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> tl_fm(x,y) \<in> formula"
+by (simp add: tl_fm_def)
+
+lemma sats_tl_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, tl_fm(x,y), env) \<longleftrightarrow> is_tl(##A, nth(x,env), nth(y,env))"
+by (simp add: tl_fm_def is_tl_def)
+
+lemma tl_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_tl(##A, x, y) \<longleftrightarrow> sats(A, tl_fm(i,j), env)"
+by simp
+
+theorem tl_reflection:
+     "REFLECTS[\<lambda>x. is_tl(L,f(x),g(x)),
+               \<lambda>i x. is_tl(##Lset(i),f(x),g(x))]"
+apply (simp only: is_tl_def)
+apply (intro FOL_reflections Nil_reflection Cons_reflection
+             quasilist_reflection empty_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_bool_of_o\<close>\<close>
+
+(*   is_bool_of_o :: "[i=>o, o, i] => o"
+   "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))" *)
+
+text\<open>The formula \<^term>\<open>p\<close> has no free variables.\<close>
+definition
+  bool_of_o_fm :: "[i, i]=>i" where
+  "bool_of_o_fm(p,z) == 
+    Or(And(p,number1_fm(z)),
+       And(Neg(p),empty_fm(z)))"
+
+lemma is_bool_of_o_type [TC]:
+     "[| p \<in> formula; z \<in> nat |] ==> bool_of_o_fm(p,z) \<in> formula"
+by (simp add: bool_of_o_fm_def)
+
+lemma sats_bool_of_o_fm:
+  assumes p_iff_sats: "P \<longleftrightarrow> sats(A, p, env)"
+  shows 
+      "[|z \<in> nat; env \<in> list(A)|]
+       ==> sats(A, bool_of_o_fm(p,z), env) \<longleftrightarrow>
+           is_bool_of_o(##A, P, nth(z,env))"
+by (simp add: bool_of_o_fm_def is_bool_of_o_def p_iff_sats [THEN iff_sym])
+
+lemma is_bool_of_o_iff_sats:
+  "[| P \<longleftrightarrow> sats(A, p, env); nth(k,env) = z; k \<in> nat; env \<in> list(A)|]
+   ==> is_bool_of_o(##A, P, z) \<longleftrightarrow> sats(A, bool_of_o_fm(p,k), env)"
+by (simp add: sats_bool_of_o_fm)
+
+theorem bool_of_o_reflection:
+     "REFLECTS [P(L), \<lambda>i. P(##Lset(i))] ==>
+      REFLECTS[\<lambda>x. is_bool_of_o(L, P(L,x), f(x)),  
+               \<lambda>i x. is_bool_of_o(##Lset(i), P(##Lset(i),x), f(x))]"
+apply (simp (no_asm) only: is_bool_of_o_def)
+apply (intro FOL_reflections function_reflections, assumption+)
+done
+
+
+subsection\<open>More Internalizations\<close>
+
+subsubsection\<open>The Operator \<^term>\<open>is_lambda\<close>\<close>
+
+text\<open>The two arguments of \<^term>\<open>p\<close> are always 1, 0. Remember that
+ \<^term>\<open>p\<close> will be enclosed by three quantifiers.\<close>
+
+(* is_lambda :: "[i=>o, i, [i,i]=>o, i] => o"
+    "is_lambda(M, A, is_b, z) == 
+       \<forall>p[M]. p \<in> z \<longleftrightarrow>
+        (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))" *)
+definition
+  lambda_fm :: "[i, i, i]=>i" where
+  "lambda_fm(p,A,z) == 
+    Forall(Iff(Member(0,succ(z)),
+            Exists(Exists(And(Member(1,A#+3),
+                           And(pair_fm(1,0,2), p))))))"
+
+text\<open>We call \<^term>\<open>p\<close> with arguments x, y by equating them with 
+  the corresponding quantified variables with de Bruijn indices 1, 0.\<close>
+
+lemma is_lambda_type [TC]:
+     "[| p \<in> formula; x \<in> nat; y \<in> nat |] 
+      ==> lambda_fm(p,x,y) \<in> formula"
+by (simp add: lambda_fm_def) 
+
+lemma sats_lambda_fm:
+  assumes is_b_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|] 
+        ==> is_b(a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,env))))"
+  shows 
+      "[|x \<in> nat; y \<in> nat; env \<in> list(A)|]
+       ==> sats(A, lambda_fm(p,x,y), env) \<longleftrightarrow> 
+           is_lambda(##A, nth(x,env), is_b, nth(y,env))"
+by (simp add: lambda_fm_def is_lambda_def is_b_iff_sats [THEN iff_sym]) 
+
+theorem is_lambda_reflection:
+  assumes is_b_reflection:
+    "!!f g h. REFLECTS[\<lambda>x. is_b(L, f(x), g(x), h(x)), 
+                     \<lambda>i x. is_b(##Lset(i), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. is_lambda(L, A(x), is_b(L,x), f(x)), 
+               \<lambda>i x. is_lambda(##Lset(i), A(x), is_b(##Lset(i),x), f(x))]"
+apply (simp (no_asm_use) only: is_lambda_def)
+apply (intro FOL_reflections is_b_reflection pair_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>is_Member\<close>, Internalized\<close>
+
+(*    "is_Member(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inl(M,u,Z)" *)
+definition
+  Member_fm :: "[i,i,i]=>i" where
+    "Member_fm(x,y,Z) ==
+       Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
+                      And(Inl_fm(1,0), Inl_fm(0,Z#+2)))))"
+
+lemma is_Member_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Member_fm(x,y,z) \<in> formula"
+by (simp add: Member_fm_def)
+
+lemma sats_Member_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Member_fm(x,y,z), env) \<longleftrightarrow>
+        is_Member(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: Member_fm_def is_Member_def)
+
+lemma Member_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_Member(##A, x, y, z) \<longleftrightarrow> sats(A, Member_fm(i,j,k), env)"
+by (simp)
+
+theorem Member_reflection:
+     "REFLECTS[\<lambda>x. is_Member(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_Member(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_Member_def)
+apply (intro FOL_reflections pair_reflection Inl_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>is_Equal\<close>, Internalized\<close>
+
+(*    "is_Equal(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inr(M,p,u) & is_Inl(M,u,Z)" *)
+definition
+  Equal_fm :: "[i,i,i]=>i" where
+    "Equal_fm(x,y,Z) ==
+       Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
+                      And(Inr_fm(1,0), Inl_fm(0,Z#+2)))))"
+
+lemma is_Equal_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Equal_fm(x,y,z) \<in> formula"
+by (simp add: Equal_fm_def)
+
+lemma sats_Equal_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Equal_fm(x,y,z), env) \<longleftrightarrow>
+        is_Equal(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: Equal_fm_def is_Equal_def)
+
+lemma Equal_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_Equal(##A, x, y, z) \<longleftrightarrow> sats(A, Equal_fm(i,j,k), env)"
+by (simp)
+
+theorem Equal_reflection:
+     "REFLECTS[\<lambda>x. is_Equal(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_Equal(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_Equal_def)
+apply (intro FOL_reflections pair_reflection Inl_reflection Inr_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>is_Nand\<close>, Internalized\<close>
+
+(*    "is_Nand(M,x,y,Z) ==
+        \<exists>p[M]. \<exists>u[M]. pair(M,x,y,p) & is_Inl(M,p,u) & is_Inr(M,u,Z)" *)
+definition
+  Nand_fm :: "[i,i,i]=>i" where
+    "Nand_fm(x,y,Z) ==
+       Exists(Exists(And(pair_fm(x#+2,y#+2,1), 
+                      And(Inl_fm(1,0), Inr_fm(0,Z#+2)))))"
+
+lemma is_Nand_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> Nand_fm(x,y,z) \<in> formula"
+by (simp add: Nand_fm_def)
+
+lemma sats_Nand_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Nand_fm(x,y,z), env) \<longleftrightarrow>
+        is_Nand(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: Nand_fm_def is_Nand_def)
+
+lemma Nand_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_Nand(##A, x, y, z) \<longleftrightarrow> sats(A, Nand_fm(i,j,k), env)"
+by (simp)
+
+theorem Nand_reflection:
+     "REFLECTS[\<lambda>x. is_Nand(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_Nand(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_Nand_def)
+apply (intro FOL_reflections pair_reflection Inl_reflection Inr_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>is_Forall\<close>, Internalized\<close>
+
+(* "is_Forall(M,p,Z) == \<exists>u[M]. is_Inr(M,p,u) & is_Inr(M,u,Z)" *)
+definition
+  Forall_fm :: "[i,i]=>i" where
+    "Forall_fm(x,Z) ==
+       Exists(And(Inr_fm(succ(x),0), Inr_fm(0,succ(Z))))"
+
+lemma is_Forall_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> Forall_fm(x,y) \<in> formula"
+by (simp add: Forall_fm_def)
+
+lemma sats_Forall_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, Forall_fm(x,y), env) \<longleftrightarrow>
+        is_Forall(##A, nth(x,env), nth(y,env))"
+by (simp add: Forall_fm_def is_Forall_def)
+
+lemma Forall_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; 
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_Forall(##A, x, y) \<longleftrightarrow> sats(A, Forall_fm(i,j), env)"
+by (simp)
+
+theorem Forall_reflection:
+     "REFLECTS[\<lambda>x. is_Forall(L,f(x),g(x)),
+               \<lambda>i x. is_Forall(##Lset(i),f(x),g(x))]"
+apply (simp only: is_Forall_def)
+apply (intro FOL_reflections pair_reflection Inr_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_and\<close>, Internalized\<close>
+
+(* is_and(M,a,b,z) == (number1(M,a)  & z=b) | 
+                       (~number1(M,a) & empty(M,z)) *)
+definition
+  and_fm :: "[i,i,i]=>i" where
+    "and_fm(a,b,z) ==
+       Or(And(number1_fm(a), Equal(z,b)),
+          And(Neg(number1_fm(a)),empty_fm(z)))"
+
+lemma is_and_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> and_fm(x,y,z) \<in> formula"
+by (simp add: and_fm_def)
+
+lemma sats_and_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, and_fm(x,y,z), env) \<longleftrightarrow>
+        is_and(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: and_fm_def is_and_def)
+
+lemma is_and_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_and(##A, x, y, z) \<longleftrightarrow> sats(A, and_fm(i,j,k), env)"
+by simp
+
+theorem is_and_reflection:
+     "REFLECTS[\<lambda>x. is_and(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_and(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_and_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_or\<close>, Internalized\<close>
+
+(* is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) | 
+                     (~number1(M,a) & z=b) *)
+
+definition
+  or_fm :: "[i,i,i]=>i" where
+    "or_fm(a,b,z) ==
+       Or(And(number1_fm(a), number1_fm(z)),
+          And(Neg(number1_fm(a)), Equal(z,b)))"
+
+lemma is_or_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> or_fm(x,y,z) \<in> formula"
+by (simp add: or_fm_def)
+
+lemma sats_or_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, or_fm(x,y,z), env) \<longleftrightarrow>
+        is_or(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: or_fm_def is_or_def)
+
+lemma is_or_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_or(##A, x, y, z) \<longleftrightarrow> sats(A, or_fm(i,j,k), env)"
+by simp
+
+theorem is_or_reflection:
+     "REFLECTS[\<lambda>x. is_or(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_or(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_or_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_not\<close>, Internalized\<close>
+
+(* is_not(M,a,z) == (number1(M,a)  & empty(M,z)) | 
+                     (~number1(M,a) & number1(M,z)) *)
+definition
+  not_fm :: "[i,i]=>i" where
+    "not_fm(a,z) ==
+       Or(And(number1_fm(a), empty_fm(z)),
+          And(Neg(number1_fm(a)), number1_fm(z)))"
+
+lemma is_not_type [TC]:
+     "[| x \<in> nat; z \<in> nat |] ==> not_fm(x,z) \<in> formula"
+by (simp add: not_fm_def)
+
+lemma sats_is_not_fm [simp]:
+   "[| x \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, not_fm(x,z), env) \<longleftrightarrow> is_not(##A, nth(x,env), nth(z,env))"
+by (simp add: not_fm_def is_not_def)
+
+lemma is_not_iff_sats:
+      "[| nth(i,env) = x; nth(k,env) = z;
+          i \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_not(##A, x, z) \<longleftrightarrow> sats(A, not_fm(i,k), env)"
+by simp
+
+theorem is_not_reflection:
+     "REFLECTS[\<lambda>x. is_not(L,f(x),g(x)),
+               \<lambda>i x. is_not(##Lset(i),f(x),g(x))]"
+apply (simp only: is_not_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+lemmas extra_reflections = 
+    Inl_reflection Inr_reflection Nil_reflection Cons_reflection
+    quasilist_reflection hd_reflection tl_reflection bool_of_o_reflection
+    is_lambda_reflection Member_reflection Equal_reflection Nand_reflection
+    Forall_reflection is_and_reflection is_or_reflection is_not_reflection
+
+subsection\<open>Well-Founded Recursion!\<close>
+
+subsubsection\<open>The Operator \<^term>\<open>M_is_recfun\<close>\<close>
+
+text\<open>Alternative definition, minimizing nesting of quantifiers around MH\<close>
+lemma M_is_recfun_iff:
+   "M_is_recfun(M,MH,r,a,f) \<longleftrightarrow>
+    (\<forall>z[M]. z \<in> f \<longleftrightarrow> 
+     (\<exists>x[M]. \<exists>f_r_sx[M]. \<exists>y[M]. 
+             MH(x, f_r_sx, y) & pair(M,x,y,z) &
+             (\<exists>xa[M]. \<exists>sx[M]. \<exists>r_sx[M]. 
+                pair(M,x,a,xa) & upair(M,x,x,sx) &
+               pre_image(M,r,sx,r_sx) & restriction(M,f,r_sx,f_r_sx) &
+               xa \<in> r)))"
+apply (simp add: M_is_recfun_def)
+apply (rule rall_cong, blast) 
+done
+
+
+(* M_is_recfun :: "[i=>o, [i,i,i]=>o, i, i, i] => o"
+   "M_is_recfun(M,MH,r,a,f) ==
+     \<forall>z[M]. z \<in> f \<longleftrightarrow>
+               2      1           0
+new def     (\<exists>x[M]. \<exists>f_r_sx[M]. \<exists>y[M]. 
+             MH(x, f_r_sx, y) & pair(M,x,y,z) &
+             (\<exists>xa[M]. \<exists>sx[M]. \<exists>r_sx[M]. 
+                pair(M,x,a,xa) & upair(M,x,x,sx) &
+               pre_image(M,r,sx,r_sx) & restriction(M,f,r_sx,f_r_sx) &
+               xa \<in> r)"
+*)
+
+text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0 and z\<close>
+definition
+  is_recfun_fm :: "[i, i, i, i]=>i" where
+  "is_recfun_fm(p,r,a,f) == 
+   Forall(Iff(Member(0,succ(f)),
+    Exists(Exists(Exists(
+     And(p, 
+      And(pair_fm(2,0,3),
+       Exists(Exists(Exists(
+        And(pair_fm(5,a#+7,2),
+         And(upair_fm(5,5,1),
+          And(pre_image_fm(r#+7,1,0),
+           And(restriction_fm(f#+7,0,4), Member(2,r#+7)))))))))))))))"
+
+lemma is_recfun_type [TC]:
+     "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
+      ==> is_recfun_fm(p,x,y,z) \<in> formula"
+by (simp add: is_recfun_fm_def)
+
+
+lemma sats_is_recfun_fm:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,env)))))"
+  shows 
+      "[|x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+       ==> sats(A, is_recfun_fm(p,x,y,z), env) \<longleftrightarrow>
+           M_is_recfun(##A, MH, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: is_recfun_fm_def M_is_recfun_iff MH_iff_sats [THEN iff_sym])
+
+lemma is_recfun_iff_sats:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,env)))))"
+  shows
+  "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
+      i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+   ==> M_is_recfun(##A, MH, x, y, z) \<longleftrightarrow> sats(A, is_recfun_fm(p,i,j,k), env)"
+by (simp add: sats_is_recfun_fm [OF MH_iff_sats]) 
+
+text\<open>The additional variable in the premise, namely \<^term>\<open>f'\<close>, is essential.
+It lets \<^term>\<open>MH\<close> depend upon \<^term>\<open>x\<close>, which seems often necessary.
+The same thing occurs in \<open>is_wfrec_reflection\<close>.\<close>
+theorem is_recfun_reflection:
+  assumes MH_reflection:
+    "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
+                     \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. M_is_recfun(L, MH(L,x), f(x), g(x), h(x)), 
+             \<lambda>i x. M_is_recfun(##Lset(i), MH(##Lset(i),x), f(x), g(x), h(x))]"
+apply (simp (no_asm_use) only: M_is_recfun_def)
+apply (intro FOL_reflections function_reflections
+             restriction_reflection MH_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>is_wfrec\<close>\<close>
+
+text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0;
+      \<^term>\<open>p\<close> is enclosed by 5 quantifiers.\<close>
+
+(* is_wfrec :: "[i=>o, i, [i,i,i]=>o, i, i] => o"
+    "is_wfrec(M,MH,r,a,z) == 
+      \<exists>f[M]. M_is_recfun(M,MH,r,a,f) & MH(a,f,z)" *)
+definition
+  is_wfrec_fm :: "[i, i, i, i]=>i" where
+  "is_wfrec_fm(p,r,a,z) == 
+    Exists(And(is_recfun_fm(p, succ(r), succ(a), 0),
+           Exists(Exists(Exists(Exists(
+             And(Equal(2,a#+5), And(Equal(1,4), And(Equal(0,z#+5), p)))))))))"
+
+text\<open>We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
+  the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
+
+text\<open>There's an additional existential quantifier to ensure that the
+      environments in both calls to MH have the same length.\<close>
+
+lemma is_wfrec_type [TC]:
+     "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
+      ==> is_wfrec_fm(p,x,y,z) \<in> formula"
+by (simp add: is_wfrec_fm_def) 
+
+lemma sats_is_wfrec_fm:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
+  shows 
+      "[|x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
+       ==> sats(A, is_wfrec_fm(p,x,y,z), env) \<longleftrightarrow> 
+           is_wfrec(##A, MH, nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=z in lt_length_in_nat, assumption)  
+apply (frule lt_length_in_nat, assumption)  
+apply (simp add: is_wfrec_fm_def sats_is_recfun_fm is_wfrec_def MH_iff_sats [THEN iff_sym], blast) 
+done
+
+
+lemma is_wfrec_iff_sats:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,Cons(a4,env))))))"
+  shows
+  "[|nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
+      i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
+   ==> is_wfrec(##A, MH, x, y, z) \<longleftrightarrow> sats(A, is_wfrec_fm(p,i,j,k), env)" 
+by (simp add: sats_is_wfrec_fm [OF MH_iff_sats])
+
+theorem is_wfrec_reflection:
+  assumes MH_reflection:
+    "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
+                     \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. is_wfrec(L, MH(L,x), f(x), g(x), h(x)), 
+               \<lambda>i x. is_wfrec(##Lset(i), MH(##Lset(i),x), f(x), g(x), h(x))]"
+apply (simp (no_asm_use) only: is_wfrec_def)
+apply (intro FOL_reflections MH_reflection is_recfun_reflection)
+done
+
+
+subsection\<open>For Datatypes\<close>
+
+subsubsection\<open>Binary Products, Internalized\<close>
+
+definition
+  cartprod_fm :: "[i,i,i]=>i" where
+(* "cartprod(M,A,B,z) ==
+        \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))" *)
+    "cartprod_fm(A,B,z) ==
+       Forall(Iff(Member(0,succ(z)),
+                  Exists(And(Member(0,succ(succ(A))),
+                         Exists(And(Member(0,succ(succ(succ(B)))),
+                                    pair_fm(1,0,2)))))))"
+
+lemma cartprod_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> cartprod_fm(x,y,z) \<in> formula"
+by (simp add: cartprod_fm_def)
+
+lemma sats_cartprod_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, cartprod_fm(x,y,z), env) \<longleftrightarrow>
+        cartprod(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: cartprod_fm_def cartprod_def)
+
+lemma cartprod_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> cartprod(##A, x, y, z) \<longleftrightarrow> sats(A, cartprod_fm(i,j,k), env)"
+by (simp)
+
+theorem cartprod_reflection:
+     "REFLECTS[\<lambda>x. cartprod(L,f(x),g(x),h(x)),
+               \<lambda>i x. cartprod(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: cartprod_def)
+apply (intro FOL_reflections pair_reflection)
+done
+
+
+subsubsection\<open>Binary Sums, Internalized\<close>
+
+(* "is_sum(M,A,B,Z) ==
+       \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
+         3      2       1        0
+       number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
+       cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"  *)
+definition
+  sum_fm :: "[i,i,i]=>i" where
+    "sum_fm(A,B,Z) ==
+       Exists(Exists(Exists(Exists(
+        And(number1_fm(2),
+            And(cartprod_fm(2,A#+4,3),
+                And(upair_fm(2,2,1),
+                    And(cartprod_fm(1,B#+4,0), union_fm(3,0,Z#+4)))))))))"
+
+lemma sum_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> sum_fm(x,y,z) \<in> formula"
+by (simp add: sum_fm_def)
+
+lemma sats_sum_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, sum_fm(x,y,z), env) \<longleftrightarrow>
+        is_sum(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: sum_fm_def is_sum_def)
+
+lemma sum_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_sum(##A, x, y, z) \<longleftrightarrow> sats(A, sum_fm(i,j,k), env)"
+by simp
+
+theorem sum_reflection:
+     "REFLECTS[\<lambda>x. is_sum(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_sum(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_sum_def)
+apply (intro FOL_reflections function_reflections cartprod_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>quasinat\<close>\<close>
+
+(* "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))" *)
+definition
+  quasinat_fm :: "i=>i" where
+    "quasinat_fm(z) == Or(empty_fm(z), Exists(succ_fm(0,succ(z))))"
+
+lemma quasinat_type [TC]:
+     "x \<in> nat ==> quasinat_fm(x) \<in> formula"
+by (simp add: quasinat_fm_def)
+
+lemma sats_quasinat_fm [simp]:
+   "[| x \<in> nat; env \<in> list(A)|]
+    ==> sats(A, quasinat_fm(x), env) \<longleftrightarrow> is_quasinat(##A, nth(x,env))"
+by (simp add: quasinat_fm_def is_quasinat_def)
+
+lemma quasinat_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; env \<in> list(A)|]
+       ==> is_quasinat(##A, x) \<longleftrightarrow> sats(A, quasinat_fm(i), env)"
+by simp
+
+theorem quasinat_reflection:
+     "REFLECTS[\<lambda>x. is_quasinat(L,f(x)),
+               \<lambda>i x. is_quasinat(##Lset(i),f(x))]"
+apply (simp only: is_quasinat_def)
+apply (intro FOL_reflections function_reflections)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_nat_case\<close>\<close>
+text\<open>I could not get it to work with the more natural assumption that 
+ \<^term>\<open>is_b\<close> takes two arguments.  Instead it must be a formula where 1 and 0
+ stand for \<^term>\<open>m\<close> and \<^term>\<open>b\<close>, respectively.\<close>
+
+(* is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o"
+    "is_nat_case(M, a, is_b, k, z) ==
+       (empty(M,k) \<longrightarrow> z=a) &
+       (\<forall>m[M]. successor(M,m,k) \<longrightarrow> is_b(m,z)) &
+       (is_quasinat(M,k) | empty(M,z))" *)
+text\<open>The formula \<^term>\<open>is_b\<close> has free variables 1 and 0.\<close>
+definition
+  is_nat_case_fm :: "[i, i, i, i]=>i" where
+ "is_nat_case_fm(a,is_b,k,z) == 
+    And(Implies(empty_fm(k), Equal(z,a)),
+        And(Forall(Implies(succ_fm(0,succ(k)), 
+                   Forall(Implies(Equal(0,succ(succ(z))), is_b)))),
+            Or(quasinat_fm(k), empty_fm(z))))"
+
+lemma is_nat_case_type [TC]:
+     "[| is_b \<in> formula;  
+         x \<in> nat; y \<in> nat; z \<in> nat |] 
+      ==> is_nat_case_fm(x,is_b,y,z) \<in> formula"
+by (simp add: is_nat_case_fm_def)
+
+lemma sats_is_nat_case_fm:
+  assumes is_b_iff_sats: 
+      "!!a. a \<in> A ==> is_b(a,nth(z, env)) \<longleftrightarrow> 
+                      sats(A, p, Cons(nth(z,env), Cons(a, env)))"
+  shows 
+      "[|x \<in> nat; y \<in> nat; z < length(env); env \<in> list(A)|]
+       ==> sats(A, is_nat_case_fm(x,p,y,z), env) \<longleftrightarrow>
+           is_nat_case(##A, nth(x,env), is_b, nth(y,env), nth(z,env))"
+apply (frule lt_length_in_nat, assumption)
+apply (simp add: is_nat_case_fm_def is_nat_case_def is_b_iff_sats [THEN iff_sym])
+done
+
+lemma is_nat_case_iff_sats:
+  "[| (!!a. a \<in> A ==> is_b(a,z) \<longleftrightarrow>
+                      sats(A, p, Cons(z, Cons(a,env))));
+      nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
+      i \<in> nat; j \<in> nat; k < length(env); env \<in> list(A)|]
+   ==> is_nat_case(##A, x, is_b, y, z) \<longleftrightarrow> sats(A, is_nat_case_fm(i,p,j,k), env)"
+by (simp add: sats_is_nat_case_fm [of A is_b])
+
+
+text\<open>The second argument of \<^term>\<open>is_b\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.  Without this
+  argument, we cannot prove reflection for \<^term>\<open>iterates_MH\<close>.\<close>
+theorem is_nat_case_reflection:
+  assumes is_b_reflection:
+    "!!h f g. REFLECTS[\<lambda>x. is_b(L, h(x), f(x), g(x)),
+                     \<lambda>i x. is_b(##Lset(i), h(x), f(x), g(x))]"
+  shows "REFLECTS[\<lambda>x. is_nat_case(L, f(x), is_b(L,x), g(x), h(x)),
+               \<lambda>i x. is_nat_case(##Lset(i), f(x), is_b(##Lset(i), x), g(x), h(x))]"
+apply (simp (no_asm_use) only: is_nat_case_def)
+apply (intro FOL_reflections function_reflections
+             restriction_reflection is_b_reflection quasinat_reflection)
+done
+
+
+subsection\<open>The Operator \<^term>\<open>iterates_MH\<close>, Needed for Iteration\<close>
+
+(*  iterates_MH :: "[i=>o, [i,i]=>o, i, i, i, i] => o"
+   "iterates_MH(M,isF,v,n,g,z) ==
+        is_nat_case(M, v, \<lambda>m u. \<exists>gm[M]. fun_apply(M,g,m,gm) & isF(gm,u),
+                    n, z)" *)
+definition
+  iterates_MH_fm :: "[i, i, i, i, i]=>i" where
+ "iterates_MH_fm(isF,v,n,g,z) == 
+    is_nat_case_fm(v, 
+      Exists(And(fun_apply_fm(succ(succ(succ(g))),2,0), 
+                     Forall(Implies(Equal(0,2), isF)))), 
+      n, z)"
+
+lemma iterates_MH_type [TC]:
+     "[| p \<in> formula;  
+         v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |] 
+      ==> iterates_MH_fm(p,v,x,y,z) \<in> formula"
+by (simp add: iterates_MH_fm_def)
+
+lemma sats_iterates_MH_fm:
+  assumes is_F_iff_sats:
+      "!!a b c d. [| a \<in> A; b \<in> A; c \<in> A; d \<in> A|]
+              ==> is_F(a,b) \<longleftrightarrow>
+                  sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d,env)))))"
+  shows 
+      "[|v \<in> nat; x \<in> nat; y \<in> nat; z < length(env); env \<in> list(A)|]
+       ==> sats(A, iterates_MH_fm(p,v,x,y,z), env) \<longleftrightarrow>
+           iterates_MH(##A, is_F, nth(v,env), nth(x,env), nth(y,env), nth(z,env))"
+apply (frule lt_length_in_nat, assumption)  
+apply (simp add: iterates_MH_fm_def iterates_MH_def sats_is_nat_case_fm 
+              is_F_iff_sats [symmetric])
+apply (rule is_nat_case_cong) 
+apply (simp_all add: setclass_def)
+done
+
+lemma iterates_MH_iff_sats:
+  assumes is_F_iff_sats:
+      "!!a b c d. [| a \<in> A; b \<in> A; c \<in> A; d \<in> A|]
+              ==> is_F(a,b) \<longleftrightarrow>
+                  sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d,env)))))"
+  shows 
+  "[| nth(i',env) = v; nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
+      i' \<in> nat; i \<in> nat; j \<in> nat; k < length(env); env \<in> list(A)|]
+   ==> iterates_MH(##A, is_F, v, x, y, z) \<longleftrightarrow>
+       sats(A, iterates_MH_fm(p,i',i,j,k), env)"
+by (simp add: sats_iterates_MH_fm [OF is_F_iff_sats]) 
+
+text\<open>The second argument of \<^term>\<open>p\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.  Without this
+  argument, we cannot prove reflection for \<^term>\<open>list_N\<close>.\<close>
+theorem iterates_MH_reflection:
+  assumes p_reflection:
+    "!!f g h. REFLECTS[\<lambda>x. p(L, h(x), f(x), g(x)),
+                     \<lambda>i x. p(##Lset(i), h(x), f(x), g(x))]"
+ shows "REFLECTS[\<lambda>x. iterates_MH(L, p(L,x), e(x), f(x), g(x), h(x)),
+               \<lambda>i x. iterates_MH(##Lset(i), p(##Lset(i),x), e(x), f(x), g(x), h(x))]"
+apply (simp (no_asm_use) only: iterates_MH_def)
+apply (intro FOL_reflections function_reflections is_nat_case_reflection
+             restriction_reflection p_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_iterates\<close>\<close>
+
+text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0;
+      \<^term>\<open>p\<close> is enclosed by 9 (??) quantifiers.\<close>
+
+(*    "is_iterates(M,isF,v,n,Z) == 
+      \<exists>sn[M]. \<exists>msn[M]. successor(M,n,sn) & membership(M,sn,msn) &
+       1       0       is_wfrec(M, iterates_MH(M,isF,v), msn, n, Z)"*)
+
+definition
+  is_iterates_fm :: "[i, i, i, i]=>i" where
+  "is_iterates_fm(p,v,n,Z) == 
+     Exists(Exists(
+      And(succ_fm(n#+2,1),
+       And(Memrel_fm(1,0),
+              is_wfrec_fm(iterates_MH_fm(p, v#+7, 2, 1, 0), 
+                          0, n#+2, Z#+2)))))"
+
+text\<open>We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
+  the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
+
+
+lemma is_iterates_type [TC]:
+     "[| p \<in> formula; x \<in> nat; y \<in> nat; z \<in> nat |] 
+      ==> is_iterates_fm(p,x,y,z) \<in> formula"
+by (simp add: is_iterates_fm_def) 
+
+lemma sats_is_iterates_fm:
+  assumes is_F_iff_sats:
+      "!!a b c d e f g h i j k. 
+              [| a \<in> A; b \<in> A; c \<in> A; d \<in> A; e \<in> A; f \<in> A; 
+                 g \<in> A; h \<in> A; i \<in> A; j \<in> A; k \<in> A|]
+              ==> is_F(a,b) \<longleftrightarrow>
+                  sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d, Cons(e, Cons(f, 
+                      Cons(g, Cons(h, Cons(i, Cons(j, Cons(k, env))))))))))))"
+  shows 
+      "[|x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
+       ==> sats(A, is_iterates_fm(p,x,y,z), env) \<longleftrightarrow>
+           is_iterates(##A, is_F, nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=z in lt_length_in_nat, assumption)  
+apply (frule lt_length_in_nat, assumption)  
+apply (simp add: is_iterates_fm_def is_iterates_def sats_is_nat_case_fm 
+              is_F_iff_sats [symmetric] sats_is_wfrec_fm sats_iterates_MH_fm)
+done
+
+
+lemma is_iterates_iff_sats:
+  assumes is_F_iff_sats:
+      "!!a b c d e f g h i j k. 
+              [| a \<in> A; b \<in> A; c \<in> A; d \<in> A; e \<in> A; f \<in> A; 
+                 g \<in> A; h \<in> A; i \<in> A; j \<in> A; k \<in> A|]
+              ==> is_F(a,b) \<longleftrightarrow>
+                  sats(A, p, Cons(b, Cons(a, Cons(c, Cons(d, Cons(e, Cons(f, 
+                      Cons(g, Cons(h, Cons(i, Cons(j, Cons(k, env))))))))))))"
+  shows 
+  "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z; 
+      i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
+   ==> is_iterates(##A, is_F, x, y, z) \<longleftrightarrow>
+       sats(A, is_iterates_fm(p,i,j,k), env)"
+by (simp add: sats_is_iterates_fm [OF is_F_iff_sats]) 
+
+text\<open>The second argument of \<^term>\<open>p\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.  Without this
+  argument, we cannot prove reflection for \<^term>\<open>list_N\<close>.\<close>
+theorem is_iterates_reflection:
+  assumes p_reflection:
+    "!!f g h. REFLECTS[\<lambda>x. p(L, h(x), f(x), g(x)),
+                     \<lambda>i x. p(##Lset(i), h(x), f(x), g(x))]"
+ shows "REFLECTS[\<lambda>x. is_iterates(L, p(L,x), f(x), g(x), h(x)),
+               \<lambda>i x. is_iterates(##Lset(i), p(##Lset(i),x), f(x), g(x), h(x))]"
+apply (simp (no_asm_use) only: is_iterates_def)
+apply (intro FOL_reflections function_reflections p_reflection
+             is_wfrec_reflection iterates_MH_reflection)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_eclose_n\<close>, Internalized\<close>
+
+(* is_eclose_n(M,A,n,Z) == is_iterates(M, big_union(M), A, n, Z) *)
+
+definition
+  eclose_n_fm :: "[i,i,i]=>i" where
+  "eclose_n_fm(A,n,Z) == is_iterates_fm(big_union_fm(1,0), A, n, Z)"
+
+lemma eclose_n_fm_type [TC]:
+ "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> eclose_n_fm(x,y,z) \<in> formula"
+by (simp add: eclose_n_fm_def)
+
+lemma sats_eclose_n_fm [simp]:
+   "[| x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
+    ==> sats(A, eclose_n_fm(x,y,z), env) \<longleftrightarrow>
+        is_eclose_n(##A, nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=z in lt_length_in_nat, assumption)  
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: eclose_n_fm_def is_eclose_n_def 
+                 sats_is_iterates_fm) 
+done
+
+lemma eclose_n_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
+       ==> is_eclose_n(##A, x, y, z) \<longleftrightarrow> sats(A, eclose_n_fm(i,j,k), env)"
+by (simp)
+
+theorem eclose_n_reflection:
+     "REFLECTS[\<lambda>x. is_eclose_n(L, f(x), g(x), h(x)),  
+               \<lambda>i x. is_eclose_n(##Lset(i), f(x), g(x), h(x))]"
+apply (simp only: is_eclose_n_def)
+apply (intro FOL_reflections function_reflections is_iterates_reflection) 
+done
+
+
+subsubsection\<open>Membership in \<^term>\<open>eclose(A)\<close>\<close>
+
+(* mem_eclose(M,A,l) == 
+      \<exists>n[M]. \<exists>eclosen[M]. 
+       finite_ordinal(M,n) & is_eclose_n(M,A,n,eclosen) & l \<in> eclosen *)
+definition
+  mem_eclose_fm :: "[i,i]=>i" where
+    "mem_eclose_fm(x,y) ==
+       Exists(Exists(
+         And(finite_ordinal_fm(1),
+           And(eclose_n_fm(x#+2,1,0), Member(y#+2,0)))))"
+
+lemma mem_eclose_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> mem_eclose_fm(x,y) \<in> formula"
+by (simp add: mem_eclose_fm_def)
+
+lemma sats_mem_eclose_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, mem_eclose_fm(x,y), env) \<longleftrightarrow> mem_eclose(##A, nth(x,env), nth(y,env))"
+by (simp add: mem_eclose_fm_def mem_eclose_def)
+
+lemma mem_eclose_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> mem_eclose(##A, x, y) \<longleftrightarrow> sats(A, mem_eclose_fm(i,j), env)"
+by simp
+
+theorem mem_eclose_reflection:
+     "REFLECTS[\<lambda>x. mem_eclose(L,f(x),g(x)),
+               \<lambda>i x. mem_eclose(##Lset(i),f(x),g(x))]"
+apply (simp only: mem_eclose_def)
+apply (intro FOL_reflections finite_ordinal_reflection eclose_n_reflection)
+done
+
+
+subsubsection\<open>The Predicate ``Is \<^term>\<open>eclose(A)\<close>''\<close>
+
+(* is_eclose(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_eclose(M,A,l) *)
+definition
+  is_eclose_fm :: "[i,i]=>i" where
+    "is_eclose_fm(A,Z) ==
+       Forall(Iff(Member(0,succ(Z)), mem_eclose_fm(succ(A),0)))"
+
+lemma is_eclose_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> is_eclose_fm(x,y) \<in> formula"
+by (simp add: is_eclose_fm_def)
+
+lemma sats_is_eclose_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, is_eclose_fm(x,y), env) \<longleftrightarrow> is_eclose(##A, nth(x,env), nth(y,env))"
+by (simp add: is_eclose_fm_def is_eclose_def)
+
+lemma is_eclose_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_eclose(##A, x, y) \<longleftrightarrow> sats(A, is_eclose_fm(i,j), env)"
+by simp
+
+theorem is_eclose_reflection:
+     "REFLECTS[\<lambda>x. is_eclose(L,f(x),g(x)),
+               \<lambda>i x. is_eclose(##Lset(i),f(x),g(x))]"
+apply (simp only: is_eclose_def)
+apply (intro FOL_reflections mem_eclose_reflection)
+done
+
+
+subsubsection\<open>The List Functor, Internalized\<close>
+
+definition
+  list_functor_fm :: "[i,i,i]=>i" where
+(* "is_list_functor(M,A,X,Z) ==
+        \<exists>n1[M]. \<exists>AX[M].
+         number1(M,n1) & cartprod(M,A,X,AX) & is_sum(M,n1,AX,Z)" *)
+    "list_functor_fm(A,X,Z) ==
+       Exists(Exists(
+        And(number1_fm(1),
+            And(cartprod_fm(A#+2,X#+2,0), sum_fm(1,0,Z#+2)))))"
+
+lemma list_functor_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> list_functor_fm(x,y,z) \<in> formula"
+by (simp add: list_functor_fm_def)
+
+lemma sats_list_functor_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, list_functor_fm(x,y,z), env) \<longleftrightarrow>
+        is_list_functor(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: list_functor_fm_def is_list_functor_def)
+
+lemma list_functor_iff_sats:
+  "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+      i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+   ==> is_list_functor(##A, x, y, z) \<longleftrightarrow> sats(A, list_functor_fm(i,j,k), env)"
+by simp
+
+theorem list_functor_reflection:
+     "REFLECTS[\<lambda>x. is_list_functor(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_list_functor(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_list_functor_def)
+apply (intro FOL_reflections number1_reflection
+             cartprod_reflection sum_reflection)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_list_N\<close>, Internalized\<close>
+
+(* "is_list_N(M,A,n,Z) == 
+      \<exists>zero[M]. empty(M,zero) & 
+                is_iterates(M, is_list_functor(M,A), zero, n, Z)" *)
+
+definition
+  list_N_fm :: "[i,i,i]=>i" where
+  "list_N_fm(A,n,Z) == 
+     Exists(
+       And(empty_fm(0),
+           is_iterates_fm(list_functor_fm(A#+9#+3,1,0), 0, n#+1, Z#+1)))"
+
+lemma list_N_fm_type [TC]:
+ "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> list_N_fm(x,y,z) \<in> formula"
+by (simp add: list_N_fm_def)
+
+lemma sats_list_N_fm [simp]:
+   "[| x \<in> nat; y < length(env); z < length(env); env \<in> list(A)|]
+    ==> sats(A, list_N_fm(x,y,z), env) \<longleftrightarrow>
+        is_list_N(##A, nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=z in lt_length_in_nat, assumption)  
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: list_N_fm_def is_list_N_def sats_is_iterates_fm) 
+done
+
+lemma list_N_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j < length(env); k < length(env); env \<in> list(A)|]
+       ==> is_list_N(##A, x, y, z) \<longleftrightarrow> sats(A, list_N_fm(i,j,k), env)"
+by (simp)
+
+theorem list_N_reflection:
+     "REFLECTS[\<lambda>x. is_list_N(L, f(x), g(x), h(x)),  
+               \<lambda>i x. is_list_N(##Lset(i), f(x), g(x), h(x))]"
+apply (simp only: is_list_N_def)
+apply (intro FOL_reflections function_reflections 
+             is_iterates_reflection list_functor_reflection) 
+done
+
+
+
+subsubsection\<open>The Predicate ``Is A List''\<close>
+
+(* mem_list(M,A,l) == 
+      \<exists>n[M]. \<exists>listn[M]. 
+       finite_ordinal(M,n) & is_list_N(M,A,n,listn) & l \<in> listn *)
+definition
+  mem_list_fm :: "[i,i]=>i" where
+    "mem_list_fm(x,y) ==
+       Exists(Exists(
+         And(finite_ordinal_fm(1),
+           And(list_N_fm(x#+2,1,0), Member(y#+2,0)))))"
+
+lemma mem_list_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> mem_list_fm(x,y) \<in> formula"
+by (simp add: mem_list_fm_def)
+
+lemma sats_mem_list_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, mem_list_fm(x,y), env) \<longleftrightarrow> mem_list(##A, nth(x,env), nth(y,env))"
+by (simp add: mem_list_fm_def mem_list_def)
+
+lemma mem_list_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> mem_list(##A, x, y) \<longleftrightarrow> sats(A, mem_list_fm(i,j), env)"
+by simp
+
+theorem mem_list_reflection:
+     "REFLECTS[\<lambda>x. mem_list(L,f(x),g(x)),
+               \<lambda>i x. mem_list(##Lset(i),f(x),g(x))]"
+apply (simp only: mem_list_def)
+apply (intro FOL_reflections finite_ordinal_reflection list_N_reflection)
+done
+
+
+subsubsection\<open>The Predicate ``Is \<^term>\<open>list(A)\<close>''\<close>
+
+(* is_list(M,A,Z) == \<forall>l[M]. l \<in> Z \<longleftrightarrow> mem_list(M,A,l) *)
+definition
+  is_list_fm :: "[i,i]=>i" where
+    "is_list_fm(A,Z) ==
+       Forall(Iff(Member(0,succ(Z)), mem_list_fm(succ(A),0)))"
+
+lemma is_list_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> is_list_fm(x,y) \<in> formula"
+by (simp add: is_list_fm_def)
+
+lemma sats_is_list_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, is_list_fm(x,y), env) \<longleftrightarrow> is_list(##A, nth(x,env), nth(y,env))"
+by (simp add: is_list_fm_def is_list_def)
+
+lemma is_list_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> is_list(##A, x, y) \<longleftrightarrow> sats(A, is_list_fm(i,j), env)"
+by simp
+
+theorem is_list_reflection:
+     "REFLECTS[\<lambda>x. is_list(L,f(x),g(x)),
+               \<lambda>i x. is_list(##Lset(i),f(x),g(x))]"
+apply (simp only: is_list_def)
+apply (intro FOL_reflections mem_list_reflection)
+done
+
+
+subsubsection\<open>The Formula Functor, Internalized\<close>
+
+definition formula_functor_fm :: "[i,i]=>i" where
+(*     "is_formula_functor(M,X,Z) ==
+        \<exists>nat'[M]. \<exists>natnat[M]. \<exists>natnatsum[M]. \<exists>XX[M]. \<exists>X3[M].
+           4           3               2       1       0
+          omega(M,nat') & cartprod(M,nat',nat',natnat) &
+          is_sum(M,natnat,natnat,natnatsum) &
+          cartprod(M,X,X,XX) & is_sum(M,XX,X,X3) &
+          is_sum(M,natnatsum,X3,Z)" *)
+    "formula_functor_fm(X,Z) ==
+       Exists(Exists(Exists(Exists(Exists(
+        And(omega_fm(4),
+         And(cartprod_fm(4,4,3),
+          And(sum_fm(3,3,2),
+           And(cartprod_fm(X#+5,X#+5,1),
+            And(sum_fm(1,X#+5,0), sum_fm(2,0,Z#+5)))))))))))"
+
+lemma formula_functor_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> formula_functor_fm(x,y) \<in> formula"
+by (simp add: formula_functor_fm_def)
+
+lemma sats_formula_functor_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, formula_functor_fm(x,y), env) \<longleftrightarrow>
+        is_formula_functor(##A, nth(x,env), nth(y,env))"
+by (simp add: formula_functor_fm_def is_formula_functor_def)
+
+lemma formula_functor_iff_sats:
+  "[| nth(i,env) = x; nth(j,env) = y;
+      i \<in> nat; j \<in> nat; env \<in> list(A)|]
+   ==> is_formula_functor(##A, x, y) \<longleftrightarrow> sats(A, formula_functor_fm(i,j), env)"
+by simp
+
+theorem formula_functor_reflection:
+     "REFLECTS[\<lambda>x. is_formula_functor(L,f(x),g(x)),
+               \<lambda>i x. is_formula_functor(##Lset(i),f(x),g(x))]"
+apply (simp only: is_formula_functor_def)
+apply (intro FOL_reflections omega_reflection
+             cartprod_reflection sum_reflection)
+done
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_formula_N\<close>, Internalized\<close>
+
+(*  "is_formula_N(M,n,Z) == 
+      \<exists>zero[M]. empty(M,zero) & 
+                is_iterates(M, is_formula_functor(M), zero, n, Z)" *) 
+definition
+  formula_N_fm :: "[i,i]=>i" where
+  "formula_N_fm(n,Z) == 
+     Exists(
+       And(empty_fm(0),
+           is_iterates_fm(formula_functor_fm(1,0), 0, n#+1, Z#+1)))"
+
+lemma formula_N_fm_type [TC]:
+ "[| x \<in> nat; y \<in> nat |] ==> formula_N_fm(x,y) \<in> formula"
+by (simp add: formula_N_fm_def)
+
+lemma sats_formula_N_fm [simp]:
+   "[| x < length(env); y < length(env); env \<in> list(A)|]
+    ==> sats(A, formula_N_fm(x,y), env) \<longleftrightarrow>
+        is_formula_N(##A, nth(x,env), nth(y,env))"
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (frule lt_length_in_nat, assumption)  
+apply (simp add: formula_N_fm_def is_formula_N_def sats_is_iterates_fm) 
+done
+
+lemma formula_N_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; 
+          i < length(env); j < length(env); env \<in> list(A)|]
+       ==> is_formula_N(##A, x, y) \<longleftrightarrow> sats(A, formula_N_fm(i,j), env)"
+by (simp)
+
+theorem formula_N_reflection:
+     "REFLECTS[\<lambda>x. is_formula_N(L, f(x), g(x)),  
+               \<lambda>i x. is_formula_N(##Lset(i), f(x), g(x))]"
+apply (simp only: is_formula_N_def)
+apply (intro FOL_reflections function_reflections 
+             is_iterates_reflection formula_functor_reflection) 
+done
+
+
+
+subsubsection\<open>The Predicate ``Is A Formula''\<close>
+
+(*  mem_formula(M,p) == 
+      \<exists>n[M]. \<exists>formn[M]. 
+       finite_ordinal(M,n) & is_formula_N(M,n,formn) & p \<in> formn *)
+definition
+  mem_formula_fm :: "i=>i" where
+    "mem_formula_fm(x) ==
+       Exists(Exists(
+         And(finite_ordinal_fm(1),
+           And(formula_N_fm(1,0), Member(x#+2,0)))))"
+
+lemma mem_formula_type [TC]:
+     "x \<in> nat ==> mem_formula_fm(x) \<in> formula"
+by (simp add: mem_formula_fm_def)
+
+lemma sats_mem_formula_fm [simp]:
+   "[| x \<in> nat; env \<in> list(A)|]
+    ==> sats(A, mem_formula_fm(x), env) \<longleftrightarrow> mem_formula(##A, nth(x,env))"
+by (simp add: mem_formula_fm_def mem_formula_def)
+
+lemma mem_formula_iff_sats:
+      "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
+       ==> mem_formula(##A, x) \<longleftrightarrow> sats(A, mem_formula_fm(i), env)"
+by simp
+
+theorem mem_formula_reflection:
+     "REFLECTS[\<lambda>x. mem_formula(L,f(x)),
+               \<lambda>i x. mem_formula(##Lset(i),f(x))]"
+apply (simp only: mem_formula_def)
+apply (intro FOL_reflections finite_ordinal_reflection formula_N_reflection)
+done
+
+
+
+subsubsection\<open>The Predicate ``Is \<^term>\<open>formula\<close>''\<close>
+
+(* is_formula(M,Z) == \<forall>p[M]. p \<in> Z \<longleftrightarrow> mem_formula(M,p) *)
+definition
+  is_formula_fm :: "i=>i" where
+    "is_formula_fm(Z) == Forall(Iff(Member(0,succ(Z)), mem_formula_fm(0)))"
+
+lemma is_formula_type [TC]:
+     "x \<in> nat ==> is_formula_fm(x) \<in> formula"
+by (simp add: is_formula_fm_def)
+
+lemma sats_is_formula_fm [simp]:
+   "[| x \<in> nat; env \<in> list(A)|]
+    ==> sats(A, is_formula_fm(x), env) \<longleftrightarrow> is_formula(##A, nth(x,env))"
+by (simp add: is_formula_fm_def is_formula_def)
+
+lemma is_formula_iff_sats:
+      "[| nth(i,env) = x; i \<in> nat; env \<in> list(A)|]
+       ==> is_formula(##A, x) \<longleftrightarrow> sats(A, is_formula_fm(i), env)"
+by simp
+
+theorem is_formula_reflection:
+     "REFLECTS[\<lambda>x. is_formula(L,f(x)),
+               \<lambda>i x. is_formula(##Lset(i),f(x))]"
+apply (simp only: is_formula_def)
+apply (intro FOL_reflections mem_formula_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_transrec\<close>\<close>
+
+text\<open>The three arguments of \<^term>\<open>p\<close> are always 2, 1, 0.  It is buried
+   within eight quantifiers!
+   We call \<^term>\<open>p\<close> with arguments a, f, z by equating them with 
+  the corresponding quantified variables with de Bruijn indices 2, 1, 0.\<close>
+
+(* is_transrec :: "[i=>o, [i,i,i]=>o, i, i] => o"
+   "is_transrec(M,MH,a,z) == 
+      \<exists>sa[M]. \<exists>esa[M]. \<exists>mesa[M]. 
+       2       1         0
+       upair(M,a,a,sa) & is_eclose(M,sa,esa) & membership(M,esa,mesa) &
+       is_wfrec(M,MH,mesa,a,z)" *)
+definition
+  is_transrec_fm :: "[i, i, i]=>i" where
+ "is_transrec_fm(p,a,z) == 
+    Exists(Exists(Exists(
+      And(upair_fm(a#+3,a#+3,2),
+       And(is_eclose_fm(2,1),
+        And(Memrel_fm(1,0), is_wfrec_fm(p,0,a#+3,z#+3)))))))"
+
+
+lemma is_transrec_type [TC]:
+     "[| p \<in> formula; x \<in> nat; z \<in> nat |] 
+      ==> is_transrec_fm(p,x,z) \<in> formula"
+by (simp add: is_transrec_fm_def) 
+
+lemma sats_is_transrec_fm:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4 a5 a6 a7. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> 
+            sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
+                          Cons(a4,Cons(a5,Cons(a6,Cons(a7,env)))))))))"
+  shows 
+      "[|x < length(env); z < length(env); env \<in> list(A)|]
+       ==> sats(A, is_transrec_fm(p,x,z), env) \<longleftrightarrow> 
+           is_transrec(##A, MH, nth(x,env), nth(z,env))"
+apply (frule_tac x=z in lt_length_in_nat, assumption)  
+apply (frule_tac x=x in lt_length_in_nat, assumption)  
+apply (simp add: is_transrec_fm_def sats_is_wfrec_fm is_transrec_def MH_iff_sats [THEN iff_sym]) 
+done
+
+
+lemma is_transrec_iff_sats:
+  assumes MH_iff_sats: 
+      "!!a0 a1 a2 a3 a4 a5 a6 a7. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A; a3\<in>A; a4\<in>A; a5\<in>A; a6\<in>A; a7\<in>A|] 
+        ==> MH(a2, a1, a0) \<longleftrightarrow> 
+            sats(A, p, Cons(a0,Cons(a1,Cons(a2,Cons(a3,
+                          Cons(a4,Cons(a5,Cons(a6,Cons(a7,env)))))))))"
+  shows
+  "[|nth(i,env) = x; nth(k,env) = z; 
+      i < length(env); k < length(env); env \<in> list(A)|]
+   ==> is_transrec(##A, MH, x, z) \<longleftrightarrow> sats(A, is_transrec_fm(p,i,k), env)" 
+by (simp add: sats_is_transrec_fm [OF MH_iff_sats])
+
+theorem is_transrec_reflection:
+  assumes MH_reflection:
+    "!!f' f g h. REFLECTS[\<lambda>x. MH(L, f'(x), f(x), g(x), h(x)), 
+                     \<lambda>i x. MH(##Lset(i), f'(x), f(x), g(x), h(x))]"
+  shows "REFLECTS[\<lambda>x. is_transrec(L, MH(L,x), f(x), h(x)), 
+               \<lambda>i x. is_transrec(##Lset(i), MH(##Lset(i),x), f(x), h(x))]"
+apply (simp (no_asm_use) only: is_transrec_def)
+apply (intro FOL_reflections function_reflections MH_reflection 
+             is_wfrec_reflection is_eclose_reflection)
+done
+
+end
diff --git a/thys/Transitive_Models/Rec_Separation.thy b/thys/Transitive_Models/Rec_Separation.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/Rec_Separation.thy
@@ -0,0 +1,440 @@
+(*  Title:      ZF/Constructible/Rec_Separation.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+section \<open>Separation for Facts About Recursion\<close>
+
+theory Rec_Separation imports "ZF-Constructible.Separation" Internalize Datatype_absolute begin
+
+text\<open>This theory proves all instances needed for locales \<open>M_trancl\<close> and \<open>M_datatypes\<close>\<close>
+
+lemma eq_succ_imp_lt: "[|i = succ(j); Ord(i)|] ==> j<i"
+by simp
+
+
+subsection\<open>The Locale \<open>M_trancl\<close>\<close>
+
+subsubsection\<open>Separation for Reflexive/Transitive Closure\<close>
+
+text\<open>First, The Defining Formula\<close>
+
+(* "rtran_closure_mem(M,A,r,p) ==
+      \<exists>nnat[M]. \<exists>n[M]. \<exists>n'[M].
+       omega(M,nnat) & n\<in>nnat & successor(M,n,n') &
+       (\<exists>f[M]. typed_function(M,n',A,f) &
+        (\<exists>x[M]. \<exists>y[M]. \<exists>zero[M]. pair(M,x,y,p) & empty(M,zero) &
+          fun_apply(M,f,zero,x) & fun_apply(M,f,n,y)) &
+        (\<forall>j[M]. j\<in>n \<longrightarrow>
+          (\<exists>fj[M]. \<exists>sj[M]. \<exists>fsj[M]. \<exists>ffp[M].
+            fun_apply(M,f,j,fj) & successor(M,j,sj) &
+            fun_apply(M,f,sj,fsj) & pair(M,fj,fsj,ffp) & ffp \<in> r)))"*)
+definition
+  rtran_closure_mem_fm :: "[i,i,i]=>i" where
+ "rtran_closure_mem_fm(A,r,p) ==
+   Exists(Exists(Exists(
+    And(omega_fm(2),
+     And(Member(1,2),
+      And(succ_fm(1,0),
+       Exists(And(typed_function_fm(1, A#+4, 0),
+        And(Exists(Exists(Exists(
+              And(pair_fm(2,1,p#+7),
+               And(empty_fm(0),
+                And(fun_apply_fm(3,0,2), fun_apply_fm(3,5,1))))))),
+            Forall(Implies(Member(0,3),
+             Exists(Exists(Exists(Exists(
+              And(fun_apply_fm(5,4,3),
+               And(succ_fm(4,2),
+                And(fun_apply_fm(5,2,1),
+                 And(pair_fm(3,1,0), Member(0,r#+9))))))))))))))))))))"
+
+
+lemma rtran_closure_mem_type [TC]:
+ "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> rtran_closure_mem_fm(x,y,z) \<in> formula"
+by (simp add: rtran_closure_mem_fm_def)
+
+lemma sats_rtran_closure_mem_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, rtran_closure_mem_fm(x,y,z), env) \<longleftrightarrow>
+        rtran_closure_mem(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: rtran_closure_mem_fm_def rtran_closure_mem_def)
+
+lemma rtran_closure_mem_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> rtran_closure_mem(##A, x, y, z) \<longleftrightarrow> sats(A, rtran_closure_mem_fm(i,j,k), env)"
+by (simp)
+
+lemma rtran_closure_mem_reflection:
+     "REFLECTS[\<lambda>x. rtran_closure_mem(L,f(x),g(x),h(x)),
+               \<lambda>i x. rtran_closure_mem(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: rtran_closure_mem_def)
+apply (intro FOL_reflections function_reflections fun_plus_reflections)
+done
+
+text\<open>Separation for \<^term>\<open>rtrancl(r)\<close>.\<close>
+lemma rtrancl_separation:
+     "[| L(r); L(A) |] ==> separation (L, rtran_closure_mem(L,A,r))"
+apply (rule gen_separation_multi [OF rtran_closure_mem_reflection, of "{r,A}"],
+       auto)
+apply (rule_tac env="[r,A]" in DPow_LsetI)
+apply (rule rtran_closure_mem_iff_sats sep_rules | simp)+
+done
+
+
+subsubsection\<open>Reflexive/Transitive Closure, Internalized\<close>
+
+(*  "rtran_closure(M,r,s) ==
+        \<forall>A[M]. is_field(M,r,A) \<longrightarrow>
+         (\<forall>p[M]. p \<in> s \<longleftrightarrow> rtran_closure_mem(M,A,r,p))" *)
+definition
+  rtran_closure_fm :: "[i,i]=>i" where
+  "rtran_closure_fm(r,s) ==
+   Forall(Implies(field_fm(succ(r),0),
+                  Forall(Iff(Member(0,succ(succ(s))),
+                             rtran_closure_mem_fm(1,succ(succ(r)),0)))))"
+
+lemma rtran_closure_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> rtran_closure_fm(x,y) \<in> formula"
+by (simp add: rtran_closure_fm_def)
+
+lemma sats_rtran_closure_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, rtran_closure_fm(x,y), env) \<longleftrightarrow>
+        rtran_closure(##A, nth(x,env), nth(y,env))"
+by (simp add: rtran_closure_fm_def rtran_closure_def)
+
+lemma rtran_closure_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> rtran_closure(##A, x, y) \<longleftrightarrow> sats(A, rtran_closure_fm(i,j), env)"
+by simp
+
+theorem rtran_closure_reflection:
+     "REFLECTS[\<lambda>x. rtran_closure(L,f(x),g(x)),
+               \<lambda>i x. rtran_closure(##Lset(i),f(x),g(x))]"
+apply (simp only: rtran_closure_def)
+apply (intro FOL_reflections function_reflections rtran_closure_mem_reflection)
+done
+
+
+subsubsection\<open>Transitive Closure of a Relation, Internalized\<close>
+
+(*  "tran_closure(M,r,t) ==
+         \<exists>s[M]. rtran_closure(M,r,s) & composition(M,r,s,t)" *)
+definition
+  tran_closure_fm :: "[i,i]=>i" where
+  "tran_closure_fm(r,s) ==
+   Exists(And(rtran_closure_fm(succ(r),0), composition_fm(succ(r),0,succ(s))))"
+
+lemma tran_closure_type [TC]:
+     "[| x \<in> nat; y \<in> nat |] ==> tran_closure_fm(x,y) \<in> formula"
+by (simp add: tran_closure_fm_def)
+
+lemma sats_tran_closure_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; env \<in> list(A)|]
+    ==> sats(A, tran_closure_fm(x,y), env) \<longleftrightarrow>
+        tran_closure(##A, nth(x,env), nth(y,env))"
+by (simp add: tran_closure_fm_def tran_closure_def)
+
+lemma tran_closure_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y;
+          i \<in> nat; j \<in> nat; env \<in> list(A)|]
+       ==> tran_closure(##A, x, y) \<longleftrightarrow> sats(A, tran_closure_fm(i,j), env)"
+by simp
+
+theorem tran_closure_reflection:
+     "REFLECTS[\<lambda>x. tran_closure(L,f(x),g(x)),
+               \<lambda>i x. tran_closure(##Lset(i),f(x),g(x))]"
+apply (simp only: tran_closure_def)
+apply (intro FOL_reflections function_reflections
+             rtran_closure_reflection composition_reflection)
+done
+
+
+subsubsection\<open>Separation for the Proof of \<open>wellfounded_on_trancl\<close>\<close>
+
+lemma wellfounded_trancl_reflects:
+  "REFLECTS[\<lambda>x. \<exists>w[L]. \<exists>wx[L]. \<exists>rp[L].
+                 w \<in> Z & pair(L,w,x,wx) & tran_closure(L,r,rp) & wx \<in> rp,
+   \<lambda>i x. \<exists>w \<in> Lset(i). \<exists>wx \<in> Lset(i). \<exists>rp \<in> Lset(i).
+       w \<in> Z & pair(##Lset(i),w,x,wx) & tran_closure(##Lset(i),r,rp) &
+       wx \<in> rp]"
+by (intro FOL_reflections function_reflections fun_plus_reflections
+          tran_closure_reflection)
+
+lemma wellfounded_trancl_separation:
+         "[| L(r); L(Z) |] ==>
+          separation (L, \<lambda>x.
+              \<exists>w[L]. \<exists>wx[L]. \<exists>rp[L].
+               w \<in> Z & pair(L,w,x,wx) & tran_closure(L,r,rp) & wx \<in> rp)"
+apply (rule gen_separation_multi [OF wellfounded_trancl_reflects, of "{r,Z}"],
+       auto)
+apply (rule_tac env="[r,Z]" in DPow_LsetI)
+apply (rule sep_rules tran_closure_iff_sats | simp)+
+done
+
+
+subsubsection\<open>Instantiating the locale \<open>M_trancl\<close>\<close>
+
+lemma M_trancl_axioms_L: "M_trancl_axioms(L)"
+  apply (rule M_trancl_axioms.intro)
+   apply (assumption | rule rtrancl_separation wellfounded_trancl_separation L_nat)+
+  done
+
+theorem M_trancl_L: "M_trancl(L)"
+by (rule M_trancl.intro [OF M_basic_L M_trancl_axioms_L])
+
+interpretation L: M_trancl L by (rule M_trancl_L)
+
+
+subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>list\<close>\<close>
+
+subsubsection\<open>Instances of Replacement for Lists\<close>
+
+lemma list_replacement1_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>y[L]. pair(L,u,y,x) \<and>
+         is_wfrec(L, iterates_MH(L, is_list_functor(L,A), 0), memsn, u, y)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) \<and>
+         is_wfrec(##Lset(i),
+                  iterates_MH(##Lset(i),
+                          is_list_functor(##Lset(i), A), 0), memsn, u, y))]"
+by (intro FOL_reflections function_reflections is_wfrec_reflection
+          iterates_MH_reflection list_functor_reflection)
+
+
+lemma list_replacement1:
+   "L(A) ==> iterates_replacement(L, is_list_functor(L,A), 0)"
+apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,A,n,0,Memrel(succ(n))}" 
+         in gen_separation_multi [OF list_replacement1_Reflects], 
+       auto)
+apply (rule_tac env="[B,A,n,0,Memrel(succ(n))]" in DPow_LsetI)
+apply (rule sep_rules is_nat_case_iff_sats list_functor_iff_sats
+            is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
+done
+
+
+lemma list_replacement2_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
+                is_iterates(L, is_list_functor(L, A), 0, u, x),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
+               is_iterates(##Lset(i), is_list_functor(##Lset(i), A), 0, u, x)]"
+by (intro FOL_reflections 
+          is_iterates_reflection list_functor_reflection)
+
+lemma list_replacement2:
+   "L(A) ==> strong_replacement(L,
+         \<lambda>n y. n\<in>nat & is_iterates(L, is_list_functor(L,A), 0, n, y))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{A,B,0,nat}" 
+         in gen_separation_multi [OF list_replacement2_Reflects], 
+       auto)
+apply (rule_tac env="[A,B,0,nat]" in DPow_LsetI)
+apply (rule sep_rules list_functor_iff_sats is_iterates_iff_sats | simp)+
+done
+
+
+subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>formula\<close>\<close>
+
+subsubsection\<open>Instances of Replacement for Formulas\<close>
+
+(*FIXME: could prove a lemma iterates_replacementI to eliminate the 
+need to expand iterates_replacement and wfrec_replacement*)
+lemma formula_replacement1_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
+         is_wfrec(L, iterates_MH(L, is_formula_functor(L), 0), memsn, u, y)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
+         is_wfrec(##Lset(i),
+                  iterates_MH(##Lset(i),
+                          is_formula_functor(##Lset(i)), 0), memsn, u, y))]"
+by (intro FOL_reflections function_reflections is_wfrec_reflection
+          iterates_MH_reflection formula_functor_reflection)
+
+lemma formula_replacement1:
+   "iterates_replacement(L, is_formula_functor(L), 0)"
+apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,n,0,Memrel(succ(n))}" 
+         in gen_separation_multi [OF formula_replacement1_Reflects], 
+       auto)
+apply (rule_tac env="[n,B,0,Memrel(succ(n))]" in DPow_LsetI)
+apply (rule sep_rules is_nat_case_iff_sats formula_functor_iff_sats
+            is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
+done
+
+lemma formula_replacement2_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
+                is_iterates(L, is_formula_functor(L), 0, u, x),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
+               is_iterates(##Lset(i), is_formula_functor(##Lset(i)), 0, u, x)]"
+by (intro FOL_reflections 
+          is_iterates_reflection formula_functor_reflection)
+
+lemma formula_replacement2:
+   "strong_replacement(L,
+         \<lambda>n y. n\<in>nat & is_iterates(L, is_formula_functor(L), 0, n, y))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,0,nat}" 
+         in gen_separation_multi [OF formula_replacement2_Reflects], 
+       auto)
+apply (rule_tac env="[B,0,nat]" in DPow_LsetI)
+apply (rule sep_rules formula_functor_iff_sats is_iterates_iff_sats | simp)+
+done
+
+text\<open>NB The proofs for type \<^term>\<open>formula\<close> are virtually identical to those
+for \<^term>\<open>list(A)\<close>.  It was a cut-and-paste job!\<close>
+
+
+subsubsection\<open>The Formula \<^term>\<open>is_nth\<close>, Internalized\<close>
+
+(* "is_nth(M,n,l,Z) ==
+      \<exists>X[M]. is_iterates(M, is_tl(M), l, n, X) & is_hd(M,X,Z)" *)
+definition
+  nth_fm :: "[i,i,i]=>i" where
+    "nth_fm(n,l,Z) == 
+       Exists(And(is_iterates_fm(tl_fm(1,0), succ(l), succ(n), 0), 
+              hd_fm(0,succ(Z))))"
+
+lemma nth_fm_type [TC]:
+ "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> nth_fm(x,y,z) \<in> formula"
+by (simp add: nth_fm_def)
+
+lemma sats_nth_fm [simp]:
+   "[| x < length(env); y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, nth_fm(x,y,z), env) \<longleftrightarrow>
+        is_nth(##A, nth(x,env), nth(y,env), nth(z,env))"
+apply (frule lt_length_in_nat, assumption)  
+apply (simp add: nth_fm_def is_nth_def sats_is_iterates_fm) 
+done
+
+lemma nth_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+          i < length(env); j \<in> nat; k \<in> nat; env \<in> list(A)|]
+       ==> is_nth(##A, x, y, z) \<longleftrightarrow> sats(A, nth_fm(i,j,k), env)"
+by (simp)
+
+theorem nth_reflection:
+     "REFLECTS[\<lambda>x. is_nth(L, f(x), g(x), h(x)),  
+               \<lambda>i x. is_nth(##Lset(i), f(x), g(x), h(x))]"
+apply (simp only: is_nth_def)
+apply (intro FOL_reflections is_iterates_reflection
+             hd_reflection tl_reflection) 
+done
+
+
+subsubsection\<open>An Instance of Replacement for \<^term>\<open>nth\<close>\<close>
+
+(*FIXME: could prove a lemma iterates_replacementI to eliminate the 
+need to expand iterates_replacement and wfrec_replacement*)
+lemma nth_replacement_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
+         is_wfrec(L, iterates_MH(L, is_tl(L), z), memsn, u, y)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
+         is_wfrec(##Lset(i),
+                  iterates_MH(##Lset(i),
+                          is_tl(##Lset(i)), z), memsn, u, y))]"
+by (intro FOL_reflections function_reflections is_wfrec_reflection
+          iterates_MH_reflection tl_reflection)
+
+lemma nth_replacement:
+   "L(w) ==> iterates_replacement(L, is_tl(L), w)"
+apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,w,Memrel(succ(n))}" 
+         in gen_separation_multi [OF nth_replacement_Reflects], 
+       auto)
+apply (rule_tac env="[B,w,Memrel(succ(n))]" in DPow_LsetI)
+apply (rule sep_rules is_nat_case_iff_sats tl_iff_sats
+            is_wfrec_iff_sats iterates_MH_iff_sats quasinat_iff_sats | simp)+
+done
+
+
+subsubsection\<open>Instantiating the locale \<open>M_datatypes\<close>\<close>
+
+lemma M_datatypes_axioms_L: "M_datatypes_axioms(L)"
+  apply (rule M_datatypes_axioms.intro)
+      apply (assumption | rule
+        list_replacement1 list_replacement2
+        formula_replacement1 formula_replacement2
+        nth_replacement)+
+  done
+
+theorem M_datatypes_L: "M_datatypes(L)"
+  apply (rule M_datatypes.intro)
+   apply (rule M_trancl_L)
+  apply (rule M_datatypes_axioms_L) 
+  done
+
+interpretation L: M_datatypes L by (rule M_datatypes_L)
+
+
+subsection\<open>\<^term>\<open>L\<close> is Closed Under the Operator \<^term>\<open>eclose\<close>\<close>
+
+subsubsection\<open>Instances of Replacement for \<^term>\<open>eclose\<close>\<close>
+
+lemma eclose_replacement1_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & (\<exists>y[L]. pair(L,u,y,x) &
+         is_wfrec(L, iterates_MH(L, big_union(L), A), memsn, u, y)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) &
+         is_wfrec(##Lset(i),
+                  iterates_MH(##Lset(i), big_union(##Lset(i)), A),
+                  memsn, u, y))]"
+by (intro FOL_reflections function_reflections is_wfrec_reflection
+          iterates_MH_reflection)
+
+lemma eclose_replacement1:
+   "L(A) ==> iterates_replacement(L, big_union(L), A)"
+apply (unfold iterates_replacement_def wfrec_replacement_def, clarify)
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,A,n,Memrel(succ(n))}" 
+         in gen_separation_multi [OF eclose_replacement1_Reflects], auto)
+apply (rule_tac env="[B,A,n,Memrel(succ(n))]" in DPow_LsetI)
+apply (rule sep_rules iterates_MH_iff_sats is_nat_case_iff_sats
+             is_wfrec_iff_sats big_union_iff_sats quasinat_iff_sats | simp)+
+done
+
+
+lemma eclose_replacement2_Reflects:
+ "REFLECTS
+   [\<lambda>x. \<exists>u[L]. u \<in> B & u \<in> nat &
+                is_iterates(L, big_union(L), A, u, x),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & u \<in> nat &
+               is_iterates(##Lset(i), big_union(##Lset(i)), A, u, x)]"
+by (intro FOL_reflections function_reflections is_iterates_reflection)
+
+lemma eclose_replacement2:
+   "L(A) ==> strong_replacement(L,
+         \<lambda>n y. n\<in>nat & is_iterates(L, big_union(L), A, n, y))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{A,B,nat}" 
+         in gen_separation_multi [OF eclose_replacement2_Reflects],
+       auto)
+apply (rule_tac env="[A,B,nat]" in DPow_LsetI)
+apply (rule sep_rules is_iterates_iff_sats big_union_iff_sats | simp)+
+done
+
+
+subsubsection\<open>Instantiating the locale \<open>M_eclose\<close>\<close>
+
+lemma M_eclose_axioms_L: "M_eclose_axioms(L)"
+  apply (rule M_eclose_axioms.intro)
+   apply (assumption | rule eclose_replacement1 eclose_replacement2)+
+  done
+
+theorem M_eclose_L: "M_eclose(L)"
+  apply (rule M_eclose.intro)
+   apply (rule M_trancl_L)
+  apply (rule M_eclose_axioms_L)
+  done
+
+interpretation L: M_eclose L by (rule M_eclose_L)
+
+
+end
diff --git a/thys/Transitive_Models/Recursion_Thms.thy b/thys/Transitive_Models/Recursion_Thms.thy
--- a/thys/Transitive_Models/Recursion_Thms.thy
+++ b/thys/Transitive_Models/Recursion_Thms.thy
@@ -1,363 +1,363 @@
 section\<open>Some enhanced theorems on recursion\<close>
 
 theory Recursion_Thms
-  imports "ZF-Constructible.Datatype_absolute"
+  imports "Eclose_Absolute"
 
 begin
 
 hide_const (open) Order.pred
 
 \<comment> \<open>Removing arities from inherited simpset\<close>
 declare arity_And [simp del] arity_Or[simp del] arity_Implies[simp del]
   arity_Exists[simp del] arity_Iff[simp del]
   arity_subset_fm [simp del] arity_ordinal_fm[simp del] arity_transset_fm[simp del]
 
 text\<open>We prove results concerning definitions by well-founded
 recursion on some relation \<^term>\<open>R\<close> and its transitive closure
 \<^term>\<open>R^*\<close>\<close>
 
 lemma fld_restrict_eq : "a \<in> A \<Longrightarrow> (r \<inter> A\<times>A)-``{a} = (r-``{a} \<inter> A)"
   by(force)
 
 lemma fld_restrict_mono : "relation(r) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> r \<inter> A\<times>A \<subseteq> r \<inter> B\<times>B"
   by(auto)
 
 lemma fld_restrict_dom :
   assumes "relation(r)" "domain(r) \<subseteq> A" "range(r)\<subseteq> A"
   shows "r\<inter> A\<times>A = r"
 proof (rule equalityI,blast,rule subsetI)
   { fix x
     assume xr: "x \<in> r"
     from xr assms have "\<exists> a b . x = \<langle>a,b\<rangle>" by (simp add: relation_def)
     then obtain a b where "\<langle>a,b\<rangle> \<in> r" "\<langle>a,b\<rangle> \<in> r\<inter>A\<times>A" "x \<in> r\<inter>A\<times>A"
       using assms xr
       by force
     then have "x\<in> r \<inter> A\<times>A" by simp
   }
   then show "x \<in> r \<Longrightarrow> x\<in> r\<inter>A\<times>A" for x .
 qed
 
 definition tr_down :: "[i,i] \<Rightarrow> i"
   where "tr_down(r,a) = (r^+)-``{a}"
 
 lemma tr_downD : "x \<in> tr_down(r,a) \<Longrightarrow> \<langle>x,a\<rangle> \<in> r^+"
   by (simp add: tr_down_def vimage_singleton_iff)
 
 lemma pred_down : "relation(r) \<Longrightarrow> r-``{a} \<subseteq> tr_down(r,a)"
   by(simp add: tr_down_def vimage_mono r_subset_trancl)
 
 lemma tr_down_mono : "relation(r) \<Longrightarrow> x \<in> r-``{a} \<Longrightarrow> tr_down(r,x) \<subseteq> tr_down(r,a)"
   by(rule subsetI,simp add:tr_down_def,auto dest: underD,force simp add: underI r_into_trancl trancl_trans)
 
 lemma rest_eq :
   assumes "relation(r)" and "r-``{a} \<subseteq> B" and "a \<in> B"
   shows "r-``{a} = (r\<inter>B\<times>B)-``{a}"
 proof (intro equalityI subsetI)
   fix x
   assume "x \<in> r-``{a}"
   then
   have "x \<in> B" using assms by (simp add: subsetD)
   from \<open>x\<in> r-``{a}\<close>
   have "\<langle>x,a\<rangle> \<in> r" using underD by simp
   then
   show "x \<in> (r\<inter>B\<times>B)-``{a}" using \<open>x\<in>B\<close> \<open>a\<in>B\<close> underI by simp
 next
   from assms
   show "x \<in> r -`` {a}" if  "x \<in> (r \<inter> B\<times>B) -`` {a}" for x
     using vimage_mono that by auto
 qed
 
 lemma wfrec_restr_eq : "r' = r \<inter> A\<times>A \<Longrightarrow> wfrec[A](r,a,H) = wfrec(r',a,H)"
   by(simp add:wfrec_on_def)
 
 lemma wfrec_restr :
   assumes rr: "relation(r)" and wfr:"wf(r)"
   shows  "a \<in> A \<Longrightarrow> tr_down(r,a) \<subseteq> A \<Longrightarrow> wfrec(r,a,H) = wfrec[A](r,a,H)"
 proof (induct a arbitrary:A rule:wf_induct_raw[OF wfr] )
   case (1 a)
   have wfRa : "wf[A](r)"
     using wf_subset wfr wf_on_def Int_lower1 by simp
   from pred_down rr
   have "r -`` {a} \<subseteq> tr_down(r, a)" .
   with 1
   have "r-``{a} \<subseteq> A" by (force simp add: subset_trans)
   {
     fix x
     assume x_a : "x \<in> r-``{a}"
     with \<open>r-``{a} \<subseteq> A\<close>
     have "x \<in> A" ..
     from pred_down rr
     have b : "r -``{x} \<subseteq> tr_down(r,x)" .
     then
     have "tr_down(r,x) \<subseteq> tr_down(r,a)"
       using tr_down_mono x_a rr by simp
     with 1
     have "tr_down(r,x) \<subseteq> A" using subset_trans by force
     have "\<langle>x,a\<rangle> \<in> r" using x_a  underD by simp
     with 1 \<open>tr_down(r,x) \<subseteq> A\<close> \<open>x \<in> A\<close>
     have "wfrec(r,x,H) = wfrec[A](r,x,H)" by simp
   }
   then
   have "x\<in> r-``{a} \<Longrightarrow> wfrec(r,x,H) =  wfrec[A](r,x,H)" for x  .
   then
   have Eq1 :"(\<lambda> x \<in> r-``{a} . wfrec(r,x,H)) = (\<lambda> x \<in> r-``{a} . wfrec[A](r,x,H))"
     using lam_cong by simp
 
   from assms
   have "wfrec(r,a,H) = H(a,\<lambda> x \<in> r-``{a} . wfrec(r,x,H))" by (simp add:wfrec)
   also
   have "... = H(a,\<lambda> x \<in> r-``{a} . wfrec[A](r,x,H))"
     using assms Eq1 by simp
   also from 1 \<open>r-``{a} \<subseteq> A\<close>
   have "... = H(a,\<lambda> x \<in> (r\<inter>A\<times>A)-``{a} . wfrec[A](r,x,H))"
     using assms rest_eq  by simp
   also from \<open>a\<in>A\<close>
   have "... = H(a,\<lambda> x \<in> (r-``{a})\<inter>A . wfrec[A](r,x,H))"
     using fld_restrict_eq by simp
   also from \<open>a\<in>A\<close> \<open>wf[A](r)\<close>
   have "... = wfrec[A](r,a,H)" using wfrec_on by simp
   finally show ?case .
 qed
 
 lemmas wfrec_tr_down = wfrec_restr[OF _ _ _ subset_refl]
 
 lemma wfrec_trans_restr : "relation(r) \<Longrightarrow> wf(r) \<Longrightarrow> trans(r) \<Longrightarrow> r-``{a}\<subseteq>A \<Longrightarrow> a \<in> A \<Longrightarrow>
   wfrec(r, a, H) = wfrec[A](r, a, H)"
   by(subgoal_tac "tr_down(r,a) \<subseteq> A",auto simp add : wfrec_restr tr_down_def trancl_eq_r)
 
 
 lemma field_trancl : "field(r^+) = field(r)"
   by (blast intro: r_into_trancl dest!: trancl_type [THEN subsetD])
 
 definition
   Rrel :: "[i\<Rightarrow>i\<Rightarrow>o,i] \<Rightarrow> i" where
   "Rrel(R,A) \<equiv> {z\<in>A\<times>A. \<exists>x y. z = \<langle>x, y\<rangle> \<and> R(x,y)}"
 
 lemma RrelI : "x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> R(x,y) \<Longrightarrow> \<langle>x,y\<rangle> \<in> Rrel(R,A)"
   unfolding Rrel_def by simp
 
 lemma Rrel_mem: "Rrel(mem,x) = Memrel(x)"
   unfolding Rrel_def Memrel_def ..
 
 lemma relation_Rrel: "relation(Rrel(R,d))"
   unfolding Rrel_def relation_def by simp
 
 lemma field_Rrel: "field(Rrel(R,d)) \<subseteq>  d"
   unfolding Rrel_def by auto
 
 lemma Rrel_mono : "A \<subseteq> B \<Longrightarrow> Rrel(R,A) \<subseteq> Rrel(R,B)"
   unfolding Rrel_def by blast
 
 lemma Rrel_restr_eq : "Rrel(R,A) \<inter> B\<times>B = Rrel(R,A\<inter>B)"
   unfolding Rrel_def by blast
 
 \<comment> \<open>We obtain this lemmas as a consequence of the previous one;
 alternatively it can be obtained using @{thm [source] Ordinal.Memrel_type}\<close>
 lemma field_Memrel : "field(Memrel(A)) \<subseteq> A"
   using Rrel_mem field_Rrel by blast
 
 lemma restrict_trancl_Rrel:
   assumes "R(w,y)"
   shows "restrict(f,Rrel(R,d)-``{y})`w
        = restrict(f,(Rrel(R,d)^+)-``{y})`w"
 proof (cases "y\<in>d")
   let ?r="Rrel(R,d)" and ?s="(Rrel(R,d))^+"
   case True
   show ?thesis
   proof (cases "w\<in>d")
     case True
     with \<open>y\<in>d\<close> assms
     have "\<langle>w,y\<rangle>\<in>?r"
       unfolding Rrel_def by blast
     then
     have "\<langle>w,y\<rangle>\<in>?s"
       using r_subset_trancl[of ?r] relation_Rrel[of R d] by blast
     with \<open>\<langle>w,y\<rangle>\<in>?r\<close>
     have "w\<in>?r-``{y}" "w\<in>?s-``{y}"
       using vimage_singleton_iff by simp_all
     then
     show ?thesis by simp
   next
     case False
     then
     have "w\<notin>domain(restrict(f,?r-``{y}))"
       using subsetD[OF field_Rrel[of R d]] by auto
     moreover from \<open>w\<notin>d\<close>
     have "w\<notin>domain(restrict(f,?s-``{y}))"
       using subsetD[OF field_Rrel[of R d], of w] field_trancl[of ?r]
         fieldI1[of w y ?s] by auto
     ultimately
     have "restrict(f,?r-``{y})`w = 0" "restrict(f,?s-``{y})`w = 0"
       unfolding apply_def by auto
     then show ?thesis by simp
   qed
 next
   let ?r="Rrel(R,d)"
   let ?s="?r^+"
   case False
   then
   have "?r-``{y}=0"
     unfolding Rrel_def by blast
   then
   have "w\<notin>?r-``{y}" by simp
   with \<open>y\<notin>d\<close> assms
   have "y\<notin>field(?s)"
     using field_trancl subsetD[OF field_Rrel[of R d]] by force
   then
   have "w\<notin>?s-``{y}"
     using vimage_singleton_iff by blast
   with \<open>w\<notin>?r-``{y}\<close>
   show ?thesis by simp
 qed
 
 lemma restrict_trans_eq:
   assumes "w \<in> y"
   shows "restrict(f,Memrel(eclose({x}))-``{y})`w
        = restrict(f,(Memrel(eclose({x}))^+)-``{y})`w"
   using assms restrict_trancl_Rrel[of mem ] Rrel_mem by (simp)
 
 lemma wf_eq_trancl:
   assumes "\<And> f y . H(y,restrict(f,R-``{y})) = H(y,restrict(f,R^+-``{y}))"
   shows  "wfrec(R, x, H) = wfrec(R^+, x, H)" (is "wfrec(?r,_,_) = wfrec(?r',_,_)")
 proof -
   have "wfrec(R, x, H) = wftrec(?r^+, x, \<lambda>y f. H(y, restrict(f,?r-``{y})))"
     unfolding wfrec_def ..
   also
   have " ... = wftrec(?r^+, x, \<lambda>y f. H(y, restrict(f,(?r^+)-``{y})))"
     using assms by simp
   also
   have " ... =  wfrec(?r^+, x, H)"
     unfolding wfrec_def using trancl_eq_r[OF relation_trancl trans_trancl] by simp
   finally
   show ?thesis .
 qed
 
 lemma transrec_equal_on_Ord:
   assumes
     "\<And>x f . Ord(x) \<Longrightarrow> foo(x,f) = bar(x,f)"
     "Ord(\<alpha>)"
   shows
     "transrec(\<alpha>, foo) = transrec(\<alpha>, bar)"
 proof -
   have "transrec(\<beta>,foo) = transrec(\<beta>,bar)" if "Ord(\<beta>)" for \<beta>
     using that
   proof (induct rule:trans_induct)
     case (step \<beta>)
     have "transrec(\<beta>, foo) = foo(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, foo))"
       using def_transrec[of "\<lambda>x. transrec(x, foo)" foo] by blast
     also from assms and step
     have " \<dots> = bar(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, foo))"
       by simp
     also from step
     have " \<dots> = bar(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, bar))"
       by (auto)
     also
     have " \<dots> = transrec(\<beta>, bar)"
       using def_transrec[of "\<lambda>x. transrec(x, bar)" bar, symmetric]
       by blast
     finally
     show "transrec(\<beta>, foo) = transrec(\<beta>, bar)" .
   qed
   with assms
   show ?thesis by simp
 qed
 
 \<comment> \<open>Next theorem is very similar to @{thm [source] transrec_equal_on_Ord}\<close>
 lemma (in M_eclose) transrec_equal_on_M:
   assumes
     "\<And>x f . M(x) \<Longrightarrow> M(f) \<Longrightarrow> foo(x,f) = bar(x,f)"
     "\<And>\<beta>. M(\<beta>) \<Longrightarrow> transrec_replacement(M,is_foo,\<beta>)" "relation2(M,is_foo,foo)"
     "strong_replacement(M, \<lambda>x y. y = \<langle>x, transrec(x, foo)\<rangle>)"
     "\<forall>x[M]. \<forall>g[M]. function(g) \<longrightarrow> M(foo(x,g))"
     "M(\<alpha>)" "Ord(\<alpha>)"
   shows
     "transrec(\<alpha>, foo) = transrec(\<alpha>, bar)"
 proof -
   have "M(transrec(x, foo))" if "Ord(x)" and "M(x)" for x
     using that assms transrec_closed[of is_foo]
     by simp
   have "transrec(\<beta>,foo) = transrec(\<beta>,bar)" "M(transrec(\<beta>,foo))" if "Ord(\<beta>)" "M(\<beta>)" for \<beta>
     using that
   proof (induct rule:trans_induct)
     case (step \<beta>)
     moreover
     assume "M(\<beta>)"
     moreover
     note \<open>Ord(\<beta>)\<Longrightarrow> M(\<beta>) \<Longrightarrow> M(transrec(\<beta>, foo))\<close>
     ultimately
     show "M(transrec(\<beta>, foo))" by blast
     with step \<open>M(\<beta>)\<close> \<open>\<And>x. Ord(x)\<Longrightarrow> M(x) \<Longrightarrow> M(transrec(x, foo))\<close>
       \<open>strong_replacement(M, \<lambda>x y. y = \<langle>x, transrec(x, foo)\<rangle>)\<close>
     have "M(\<lambda>x\<in>\<beta>. transrec(x, foo))"
       using Ord_in_Ord transM[of _ \<beta>]
       by (rule_tac lam_closed) auto
     have "transrec(\<beta>, foo) = foo(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, foo))"
       using def_transrec[of "\<lambda>x. transrec(x, foo)" foo] by blast
     also from assms and \<open>M(\<lambda>x\<in>\<beta>. transrec(x, foo))\<close> \<open>M(\<beta>)\<close>
     have " \<dots> = bar(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, foo))"
       by simp
     also from step and \<open>M(\<beta>)\<close>
     have " \<dots> = bar(\<beta>, \<lambda>x\<in>\<beta>. transrec(x, bar))"
       using transM[of _ \<beta>] by (auto)
     also
     have " \<dots> = transrec(\<beta>, bar)"
       using def_transrec[of "\<lambda>x. transrec(x, bar)" bar, symmetric]
       by blast
     finally
     show "transrec(\<beta>, foo) = transrec(\<beta>, bar)" .
   qed
   with assms
   show ?thesis by simp
 qed
 
 
 lemma ordermap_restr_eq:
   assumes "well_ord(X,r)"
   shows "ordermap(X, r) = ordermap(X, r \<inter> X\<times>X)"
 proof -
   let ?A="\<lambda>x . Order.pred(X, x, r)"
   let ?B="\<lambda>x . Order.pred(X, x, r \<inter> X \<times> X)"
   let ?F="\<lambda>x f. f `` ?A(x)"
   let ?G="\<lambda>x f. f `` ?B(x)"
   let ?P="\<lambda> z. z\<in>X \<longrightarrow> wfrec(r \<inter> X \<times> X,z,\<lambda>x f. f `` ?A(x)) = wfrec(r \<inter> X \<times> X,z,\<lambda>x f. f `` ?B(x))"
   have pred_eq:
     "Order.pred(X, x, r \<inter> X \<times> X) = Order.pred(X, x, r)" if "x\<in>X" for x
     unfolding Order.pred_def using that by auto
   from assms
   have wf_onX:"wf(r \<inter> X \<times> X)" unfolding well_ord_def wf_on_def by simp
   {
     have "?P(z)" for z
     proof(induct rule:wf_induct[where P="?P",OF wf_onX])
       case (1 x)
       {
         assume "x\<in>X"
         from 1
         have lam_eq:
           "(\<lambda>w\<in>(r \<inter> X \<times> X) -`` {x}. wfrec(r \<inter> X \<times> X, w, ?F)) =
              (\<lambda>w\<in>(r \<inter> X \<times> X) -`` {x}. wfrec(r \<inter> X \<times> X, w, ?G))" (is "?L=?R")
         proof -
           have "wfrec(r \<inter> X \<times> X, w, ?F) = wfrec(r \<inter> X \<times> X, w, ?G)" if "w\<in>(r\<inter>X\<times>X)-``{x}" for w
             using 1 that by auto
           then show ?thesis using lam_cong[OF refl] by simp
         qed
         then
         have "wfrec(r \<inter> X \<times> X, x, ?F) = ?L `` ?A(x)"
           using wfrec[OF wf_onX,of x ?F] by simp
         also have "... =  ?R `` ?B(x)"
           using lam_eq pred_eq[OF \<open>x\<in>_\<close>] by simp
         also
         have "... = wfrec(r \<inter> X \<times> X, x, ?G)"
           using wfrec[OF wf_onX,of x ?G] by simp
         finally
         have "wfrec(r \<inter> X \<times> X, x, ?F) = wfrec(r \<inter> X \<times> X, x, ?G)" by simp
       }
       then
       show ?case by simp
     qed
   }
   then
   show ?thesis
     unfolding ordermap_def wfrec_on_def using Int_ac by simp
 qed
 
 end
diff --git a/thys/Transitive_Models/Relativization.thy b/thys/Transitive_Models/Relativization.thy
--- a/thys/Transitive_Models/Relativization.thy
+++ b/thys/Transitive_Models/Relativization.thy
@@ -1,140 +1,131 @@
 section\<open>Automatic relativization of terms and formulas\<close>
 
 text\<open>Relativization of terms and formulas. Relativization of formulas shares relativized terms as
 far as possible; assuming that the witnesses for the relativized terms are always unique.\<close>
 
 theory Relativization
   imports
-    "ZF-Constructible.Datatype_absolute"
+    "Eclose_Absolute"
     Higher_Order_Constructs
   keywords
     "relativize" :: thy_decl % "ML"
     and
     "relativize_tm" :: thy_decl % "ML"
     and
     "reldb_add" :: thy_decl % "ML"
     and
     "reldb_rem" :: thy_decl % "ML"
     and
     "relationalize" :: thy_decl % "ML"
     and
     "rel_closed" :: thy_goal_stmt % "ML"
     and
     "is_iff_rel" :: thy_goal_stmt % "ML"
     and
     "univalent" :: thy_goal_stmt % "ML"
     and
     "absolute"
     and
     "functional"
     and
     "relational"
     and
     "external"
     and
     "for"
 
 begin
 
 ML_file\<open>Relativization_Database.ml\<close>
 
 ML\<open>
 structure Absoluteness = Named_Thms
   (val name = @{binding "absolut"}
    val description = "Theorems of absoulte terms and predicates.")
 \<close>
 setup\<open>Absoluteness.setup\<close>
 
 lemmas relative_abs =
   M_trans.empty_abs
   M_trans.pair_abs
   M_trivial.cartprod_abs
   M_trans.union_abs
   M_trans.inter_abs
   M_trans.setdiff_abs
   M_trans.Union_abs
   M_trivial.cons_abs
   (*M_trans.upair_abs*)
   M_trivial.successor_abs
   M_trans.Collect_abs
   M_trans.Replace_abs
   M_trivial.lambda_abs2
   M_trans.image_abs
   (*M_trans.powerset_abs*)
   M_trivial.nat_case_abs
   (*
   M_trans.transitive_set_abs
   M_trans.ordinal_abs
   M_trivial.limit_ordinal_abs
   M_trivial.successor_ordinal_abs
   M_trivial.finite_ordinal_abs
 *)
   M_trivial.omega_abs
   M_basic.sum_abs
   M_trivial.Inl_abs
   M_trivial.Inr_abs
   M_basic.converse_abs
   M_basic.vimage_abs
   M_trans.domain_abs
   M_trans.range_abs
   M_basic.field_abs
   (* M_basic.apply_abs *)
   (*
   M_trivial.typed_function_abs
   M_basic.injection_abs
   M_basic.surjection_abs
   M_basic.bijection_abs
   *)
   M_basic.composition_abs
   M_trans.restriction_abs
   M_trans.Inter_abs
   M_trivial.bool_of_o_abs
   M_trivial.not_abs
   M_trivial.and_abs
   M_trivial.or_abs
   M_trivial.Nil_abs
   M_trivial.Cons_abs
   (*M_trivial.quasilist_abs*)
   M_trivial.list_case_abs
   M_trivial.hd_abs
   M_trivial.tl_abs
   M_trivial.least_abs'
   M_eclose.transrec_abs
   M_trans.If_abs
   M_trans.The_abs
   M_eclose.recursor_abs
   M_trancl.trans_wfrec_abs
   M_trancl.trans_wfrec_on_abs
 
 lemmas datatype_abs =
-  M_datatypes.list_N_abs
-  M_datatypes.list_abs
-  M_datatypes.formula_N_abs
-  M_datatypes.formula_abs
   M_eclose.is_eclose_n_abs
   M_eclose.eclose_abs
-  M_datatypes.length_abs
-  M_datatypes.nth_abs
   M_trivial.Member_abs
   M_trivial.Equal_abs
   M_trivial.Nand_abs
   M_trivial.Forall_abs
-  M_datatypes.depth_abs
-  M_datatypes.formula_case_abs
 
 declare relative_abs[absolut]
-declare datatype_abs[absolut]
 
 ML_file\<open>Relativization.ml\<close>
 
 setup\<open>Relativization.init_db Relativization.db \<close>
 
 declare relative_abs[Rel]
 (*TODO: check all the duplicate cases here.*)
 declare datatype_abs[Rel]
 
 ML\<open>
 val db = Relativization.get_db @{context}
 \<close>
 
 end
diff --git a/thys/Transitive_Models/Satisfies_absolute.thy b/thys/Transitive_Models/Satisfies_absolute.thy
new file mode 100644
--- /dev/null
+++ b/thys/Transitive_Models/Satisfies_absolute.thy
@@ -0,0 +1,1040 @@
+(*  Title:      ZF/Constructible/Satisfies_absolute.thy
+    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
+*)
+
+section \<open>Absoluteness for the Satisfies Relation on Formulas\<close>
+
+theory Satisfies_absolute imports Datatype_absolute Rec_Separation begin 
+
+
+subsection \<open>More Internalization\<close>
+
+subsubsection\<open>The Formula \<^term>\<open>is_depth\<close>, Internalized\<close>
+
+(*    "is_depth(M,p,n) == 
+       \<exists>sn[M]. \<exists>formula_n[M]. \<exists>formula_sn[M]. 
+         2          1                0
+        is_formula_N(M,n,formula_n) & p \<notin> formula_n &
+        successor(M,n,sn) & is_formula_N(M,sn,formula_sn) & p \<in> formula_sn" *)
+definition
+  depth_fm :: "[i,i]=>i" where
+  "depth_fm(p,n) == 
+     Exists(Exists(Exists(
+       And(formula_N_fm(n#+3,1),
+         And(Neg(Member(p#+3,1)),
+          And(succ_fm(n#+3,2),
+           And(formula_N_fm(2,0), Member(p#+3,0))))))))"
+
+lemma depth_fm_type [TC]:
+ "[| x \<in> nat; y \<in> nat |] ==> depth_fm(x,y) \<in> formula"
+by (simp add: depth_fm_def)
+
+lemma sats_depth_fm [simp]:
+   "[| x \<in> nat; y < length(env); env \<in> list(A)|]
+    ==> sats(A, depth_fm(x,y), env) \<longleftrightarrow>
+        is_depth(##A, nth(x,env), nth(y,env))"
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: depth_fm_def is_depth_def) 
+done
+
+lemma depth_iff_sats:
+      "[| nth(i,env) = x; nth(j,env) = y; 
+          i \<in> nat; j < length(env); env \<in> list(A)|]
+       ==> is_depth(##A, x, y) \<longleftrightarrow> sats(A, depth_fm(i,j), env)"
+by (simp)
+
+theorem depth_reflection:
+     "REFLECTS[\<lambda>x. is_depth(L, f(x), g(x)),  
+               \<lambda>i x. is_depth(##Lset(i), f(x), g(x))]"
+apply (simp only: is_depth_def)
+apply (intro FOL_reflections function_reflections formula_N_reflection) 
+done
+
+
+
+subsubsection\<open>The Operator \<^term>\<open>is_formula_case\<close>\<close>
+
+text\<open>The arguments of \<^term>\<open>is_a\<close> are always 2, 1, 0, and the formula
+      will be enclosed by three quantifiers.\<close>
+
+(* is_formula_case :: 
+    "[i=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i,i]=>o, [i,i]=>o, i, i] => o"
+  "is_formula_case(M, is_a, is_b, is_c, is_d, v, z) == 
+      (\<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> is_Member(M,x,y,v) \<longrightarrow> is_a(x,y,z)) &
+      (\<forall>x[M]. \<forall>y[M]. x\<in>nat \<longrightarrow> y\<in>nat \<longrightarrow> is_Equal(M,x,y,v) \<longrightarrow> is_b(x,y,z)) &
+      (\<forall>x[M]. \<forall>y[M]. x\<in>formula \<longrightarrow> y\<in>formula \<longrightarrow> 
+                     is_Nand(M,x,y,v) \<longrightarrow> is_c(x,y,z)) &
+      (\<forall>x[M]. x\<in>formula \<longrightarrow> is_Forall(M,x,v) \<longrightarrow> is_d(x,z))" *)
+
+definition
+  formula_case_fm :: "[i, i, i, i, i, i]=>i" where
+  "formula_case_fm(is_a, is_b, is_c, is_d, v, z) == 
+        And(Forall(Forall(Implies(finite_ordinal_fm(1), 
+                           Implies(finite_ordinal_fm(0), 
+                            Implies(Member_fm(1,0,v#+2), 
+                             Forall(Implies(Equal(0,z#+3), is_a))))))),
+        And(Forall(Forall(Implies(finite_ordinal_fm(1), 
+                           Implies(finite_ordinal_fm(0), 
+                            Implies(Equal_fm(1,0,v#+2), 
+                             Forall(Implies(Equal(0,z#+3), is_b))))))),
+        And(Forall(Forall(Implies(mem_formula_fm(1), 
+                           Implies(mem_formula_fm(0), 
+                            Implies(Nand_fm(1,0,v#+2), 
+                             Forall(Implies(Equal(0,z#+3), is_c))))))),
+        Forall(Implies(mem_formula_fm(0), 
+                       Implies(Forall_fm(0,succ(v)), 
+                             Forall(Implies(Equal(0,z#+2), is_d))))))))"
+
+
+lemma is_formula_case_type [TC]:
+     "[| is_a \<in> formula;  is_b \<in> formula;  is_c \<in> formula;  is_d \<in> formula;  
+         x \<in> nat; y \<in> nat |] 
+      ==> formula_case_fm(is_a, is_b, is_c, is_d, x, y) \<in> formula"
+by (simp add: formula_case_fm_def)
+
+lemma sats_formula_case_fm:
+  assumes is_a_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISA(a2, a1, a0) \<longleftrightarrow> sats(A, is_a, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_b_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISB(a2, a1, a0) \<longleftrightarrow> sats(A, is_b, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_c_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISC(a2, a1, a0) \<longleftrightarrow> sats(A, is_c, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_d_iff_sats: 
+      "!!a0 a1. 
+        [|a0\<in>A; a1\<in>A|]  
+        ==> ISD(a1, a0) \<longleftrightarrow> sats(A, is_d, Cons(a0,Cons(a1,env)))"
+  shows 
+      "[|x \<in> nat; y < length(env); env \<in> list(A)|]
+       ==> sats(A, formula_case_fm(is_a,is_b,is_c,is_d,x,y), env) \<longleftrightarrow>
+           is_formula_case(##A, ISA, ISB, ISC, ISD, nth(x,env), nth(y,env))"
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: formula_case_fm_def is_formula_case_def 
+                 is_a_iff_sats [THEN iff_sym] is_b_iff_sats [THEN iff_sym]
+                 is_c_iff_sats [THEN iff_sym] is_d_iff_sats [THEN iff_sym])
+done
+
+lemma formula_case_iff_sats:
+  assumes is_a_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISA(a2, a1, a0) \<longleftrightarrow> sats(A, is_a, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_b_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISB(a2, a1, a0) \<longleftrightarrow> sats(A, is_b, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_c_iff_sats: 
+      "!!a0 a1 a2. 
+        [|a0\<in>A; a1\<in>A; a2\<in>A|]  
+        ==> ISC(a2, a1, a0) \<longleftrightarrow> sats(A, is_c, Cons(a0,Cons(a1,Cons(a2,env))))"
+  and is_d_iff_sats: 
+      "!!a0 a1. 
+        [|a0\<in>A; a1\<in>A|]  
+        ==> ISD(a1, a0) \<longleftrightarrow> sats(A, is_d, Cons(a0,Cons(a1,env)))"
+  shows 
+      "[|nth(i,env) = x; nth(j,env) = y; 
+      i \<in> nat; j < length(env); env \<in> list(A)|]
+       ==> is_formula_case(##A, ISA, ISB, ISC, ISD, x, y) \<longleftrightarrow>
+           sats(A, formula_case_fm(is_a,is_b,is_c,is_d,i,j), env)"
+by (simp add: sats_formula_case_fm [OF is_a_iff_sats is_b_iff_sats 
+                                       is_c_iff_sats is_d_iff_sats])
+
+
+text\<open>The second argument of \<^term>\<open>is_a\<close> gives it direct access to \<^term>\<open>x\<close>,
+  which is essential for handling free variable references.  Treatment is
+  based on that of \<open>is_nat_case_reflection\<close>.\<close>
+theorem is_formula_case_reflection:
+  assumes is_a_reflection:
+    "!!h f g g'. REFLECTS[\<lambda>x. is_a(L, h(x), f(x), g(x), g'(x)),
+                     \<lambda>i x. is_a(##Lset(i), h(x), f(x), g(x), g'(x))]"
+  and is_b_reflection:
+    "!!h f g g'. REFLECTS[\<lambda>x. is_b(L, h(x), f(x), g(x), g'(x)),
+                     \<lambda>i x. is_b(##Lset(i), h(x), f(x), g(x), g'(x))]"
+  and is_c_reflection:
+    "!!h f g g'. REFLECTS[\<lambda>x. is_c(L, h(x), f(x), g(x), g'(x)),
+                     \<lambda>i x. is_c(##Lset(i), h(x), f(x), g(x), g'(x))]"
+  and is_d_reflection:
+    "!!h f g g'. REFLECTS[\<lambda>x. is_d(L, h(x), f(x), g(x)),
+                     \<lambda>i x. is_d(##Lset(i), h(x), f(x), g(x))]"
+  shows "REFLECTS[\<lambda>x. is_formula_case(L, is_a(L,x), is_b(L,x), is_c(L,x), is_d(L,x), g(x), h(x)),
+               \<lambda>i x. is_formula_case(##Lset(i), is_a(##Lset(i), x), is_b(##Lset(i), x), is_c(##Lset(i), x), is_d(##Lset(i), x), g(x), h(x))]"
+apply (simp (no_asm_use) only: is_formula_case_def)
+apply (intro FOL_reflections function_reflections finite_ordinal_reflection
+         mem_formula_reflection
+         Member_reflection Equal_reflection Nand_reflection Forall_reflection
+         is_a_reflection is_b_reflection is_c_reflection is_d_reflection)
+done
+
+
+
+subsection \<open>Absoluteness for the Function \<^term>\<open>satisfies\<close>\<close>
+
+definition
+  is_depth_apply :: "[i=>o,i,i,i] => o" where
+   \<comment> \<open>Merely a useful abbreviation for the sequel.\<close>
+  "is_depth_apply(M,h,p,z) ==
+    \<exists>dp[M]. \<exists>sdp[M]. \<exists>hsdp[M]. 
+        finite_ordinal(M,dp) & is_depth(M,p,dp) & successor(M,dp,sdp) &
+        fun_apply(M,h,sdp,hsdp) & fun_apply(M,hsdp,p,z)"
+
+lemma (in M_datatypes) is_depth_apply_abs [simp]:
+     "[|M(h); p \<in> formula; M(z)|] 
+      ==> is_depth_apply(M,h,p,z) \<longleftrightarrow> z = h ` succ(depth(p)) ` p"
+by (simp add: is_depth_apply_def formula_into_M depth_type eq_commute)
+
+
+
+text\<open>There is at present some redundancy between the relativizations in
+ e.g. \<open>satisfies_is_a\<close> and those in e.g. \<open>Member_replacement\<close>.\<close>
+
+text\<open>These constants let us instantiate the parameters \<^term>\<open>a\<close>, \<^term>\<open>b\<close>,
+      \<^term>\<open>c\<close>, \<^term>\<open>d\<close>, etc., of the locale \<open>Formula_Rec\<close>.\<close>
+definition
+  satisfies_a :: "[i,i,i]=>i" where
+   "satisfies_a(A) == 
+    \<lambda>x y. \<lambda>env \<in> list(A). bool_of_o (nth(x,env) \<in> nth(y,env))"
+
+definition
+  satisfies_is_a :: "[i=>o,i,i,i,i]=>o" where
+   "satisfies_is_a(M,A) == 
+    \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. is_bool_of_o(M, 
+                      \<exists>nx[M]. \<exists>ny[M]. 
+                       is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & nx \<in> ny, z),
+                zz)"
+
+definition
+  satisfies_b :: "[i,i,i]=>i" where
+   "satisfies_b(A) ==
+    \<lambda>x y. \<lambda>env \<in> list(A). bool_of_o (nth(x,env) = nth(y,env))"
+
+definition
+  satisfies_is_b :: "[i=>o,i,i,i,i]=>o" where
+   \<comment> \<open>We simplify the formula to have just \<^term>\<open>nx\<close> rather than 
+       introducing \<^term>\<open>ny\<close> with  \<^term>\<open>nx=ny\<close>\<close>
+  "satisfies_is_b(M,A) == 
+    \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. is_bool_of_o(M, 
+                      \<exists>nx[M]. is_nth(M,x,env,nx) & is_nth(M,y,env,nx), z),
+                zz)"
+
+definition 
+  satisfies_c :: "[i,i,i,i,i]=>i" where
+   "satisfies_c(A) == \<lambda>p q rp rq. \<lambda>env \<in> list(A). not(rp ` env and rq ` env)"
+
+definition
+  satisfies_is_c :: "[i=>o,i,i,i,i,i]=>o" where
+   "satisfies_is_c(M,A,h) == 
+    \<lambda>p q zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, \<lambda>env z. \<exists>hp[M]. \<exists>hq[M]. 
+                 (\<exists>rp[M]. is_depth_apply(M,h,p,rp) & fun_apply(M,rp,env,hp)) & 
+                 (\<exists>rq[M]. is_depth_apply(M,h,q,rq) & fun_apply(M,rq,env,hq)) & 
+                 (\<exists>pq[M]. is_and(M,hp,hq,pq) & is_not(M,pq,z)),
+                zz)"
+
+definition
+  satisfies_d :: "[i,i,i]=>i" where
+   "satisfies_d(A) 
+    == \<lambda>p rp. \<lambda>env \<in> list(A). bool_of_o (\<forall>x\<in>A. rp ` (Cons(x,env)) = 1)"
+
+definition
+  satisfies_is_d :: "[i=>o,i,i,i,i]=>o" where
+   "satisfies_is_d(M,A,h) == 
+    \<lambda>p zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. \<exists>rp[M]. is_depth_apply(M,h,p,rp) & 
+                    is_bool_of_o(M, 
+                           \<forall>x[M]. \<forall>xenv[M]. \<forall>hp[M]. 
+                              x\<in>A \<longrightarrow> is_Cons(M,x,env,xenv) \<longrightarrow> 
+                              fun_apply(M,rp,xenv,hp) \<longrightarrow> number1(M,hp),
+                  z),
+               zz)"
+
+definition
+  satisfies_MH :: "[i=>o,i,i,i,i]=>o" where
+    \<comment> \<open>The variable \<^term>\<open>u\<close> is unused, but gives \<^term>\<open>satisfies_MH\<close> 
+        the correct arity.\<close>
+  "satisfies_MH == 
+    \<lambda>M A u f z. 
+         \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
+             is_lambda (M, fml, 
+               is_formula_case (M, satisfies_is_a(M,A), 
+                                satisfies_is_b(M,A), 
+                                satisfies_is_c(M,A,f), satisfies_is_d(M,A,f)),
+               z)"
+
+definition
+  is_satisfies :: "[i=>o,i,i,i]=>o" where
+  "is_satisfies(M,A) == is_formula_rec (M, satisfies_MH(M,A))"
+
+
+text\<open>This lemma relates the fragments defined above to the original primitive
+      recursion in \<^term>\<open>satisfies\<close>.
+      Induction is not required: the definitions are directly equal!\<close>
+lemma satisfies_eq:
+  "satisfies(A,p) = 
+   formula_rec (satisfies_a(A), satisfies_b(A), 
+                satisfies_c(A), satisfies_d(A), p)"
+by (simp add: satisfies_formula_def satisfies_a_def satisfies_b_def 
+              satisfies_c_def satisfies_d_def) 
+
+text\<open>Further constraints on the class \<^term>\<open>M\<close> in order to prove
+      absoluteness for the constants defined above.  The ultimate goal
+      is the absoluteness of the function \<^term>\<open>satisfies\<close>.\<close>
+locale M_satisfies = M_eclose + M_datatypes +
+ assumes 
+   Member_replacement:
+    "[|M(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (M, \<lambda>env z. \<exists>bo[M]. \<exists>nx[M]. \<exists>ny[M]. 
+              env \<in> list(A) & is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & 
+              is_bool_of_o(M, nx \<in> ny, bo) &
+              pair(M, env, bo, z))"
+ and
+   Equal_replacement:
+    "[|M(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (M, \<lambda>env z. \<exists>bo[M]. \<exists>nx[M]. \<exists>ny[M]. 
+              env \<in> list(A) & is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & 
+              is_bool_of_o(M, nx = ny, bo) &
+              pair(M, env, bo, z))"
+ and
+   Nand_replacement:
+    "[|M(A); M(rp); M(rq)|]
+     ==> strong_replacement
+         (M, \<lambda>env z. \<exists>rpe[M]. \<exists>rqe[M]. \<exists>andpq[M]. \<exists>notpq[M]. 
+               fun_apply(M,rp,env,rpe) & fun_apply(M,rq,env,rqe) & 
+               is_and(M,rpe,rqe,andpq) & is_not(M,andpq,notpq) & 
+               env \<in> list(A) & pair(M, env, notpq, z))"
+ and
+  Forall_replacement:
+   "[|M(A); M(rp)|]
+    ==> strong_replacement
+        (M, \<lambda>env z. \<exists>bo[M]. 
+              env \<in> list(A) & 
+              is_bool_of_o (M, 
+                            \<forall>a[M]. \<forall>co[M]. \<forall>rpco[M]. 
+                               a\<in>A \<longrightarrow> is_Cons(M,a,env,co) \<longrightarrow>
+                               fun_apply(M,rp,co,rpco) \<longrightarrow> number1(M, rpco), 
+                            bo) &
+              pair(M,env,bo,z))"
+ and
+  formula_rec_replacement: 
+      \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
+   "[|n \<in> nat; M(A)|] ==> transrec_replacement(M, satisfies_MH(M,A), n)"
+ and
+  formula_rec_lambda_replacement:  
+      \<comment> \<open>For the \<open>\<lambda>-abstraction\<close> in the \<^term>\<open>transrec\<close> body\<close>
+   "[|M(g); M(A)|] ==>
+    strong_replacement (M, 
+       \<lambda>x y. mem_formula(M,x) &
+             (\<exists>c[M]. is_formula_case(M, satisfies_is_a(M,A),
+                                  satisfies_is_b(M,A),
+                                  satisfies_is_c(M,A,g),
+                                  satisfies_is_d(M,A,g), x, c) &
+             pair(M, x, c, y)))"
+
+
+lemma (in M_satisfies) Member_replacement':
+    "[|M(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (M, \<lambda>env z. env \<in> list(A) &
+                     z = \<langle>env, bool_of_o(nth(x, env) \<in> nth(y, env))\<rangle>)"
+by (insert Member_replacement, simp) 
+
+lemma (in M_satisfies) Equal_replacement':
+    "[|M(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (M, \<lambda>env z. env \<in> list(A) &
+                     z = \<langle>env, bool_of_o(nth(x, env) = nth(y, env))\<rangle>)"
+by (insert Equal_replacement, simp) 
+
+lemma (in M_satisfies) Nand_replacement':
+    "[|M(A); M(rp); M(rq)|]
+     ==> strong_replacement
+         (M, \<lambda>env z. env \<in> list(A) & z = \<langle>env, not(rp`env and rq`env)\<rangle>)"
+by (insert Nand_replacement, simp) 
+
+lemma (in M_satisfies) Forall_replacement':
+   "[|M(A); M(rp)|]
+    ==> strong_replacement
+        (M, \<lambda>env z.
+               env \<in> list(A) &
+               z = \<langle>env, bool_of_o (\<forall>a\<in>A. rp ` Cons(a,env) = 1)\<rangle>)"
+by (insert Forall_replacement, simp) 
+
+lemma (in M_satisfies) a_closed:
+     "[|M(A); x\<in>nat; y\<in>nat|] ==> M(satisfies_a(A,x,y))"
+apply (simp add: satisfies_a_def) 
+apply (blast intro: lam_closed2 Member_replacement') 
+done
+
+lemma (in M_satisfies) a_rel:
+     "M(A) ==> Relation2(M, nat, nat, satisfies_is_a(M,A), satisfies_a(A))"
+apply (simp add: Relation2_def satisfies_is_a_def satisfies_a_def)
+apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
+done
+
+lemma (in M_satisfies) b_closed:
+     "[|M(A); x\<in>nat; y\<in>nat|] ==> M(satisfies_b(A,x,y))"
+apply (simp add: satisfies_b_def) 
+apply (blast intro: lam_closed2 Equal_replacement') 
+done
+
+lemma (in M_satisfies) b_rel:
+     "M(A) ==> Relation2(M, nat, nat, satisfies_is_b(M,A), satisfies_b(A))"
+apply (simp add: Relation2_def satisfies_is_b_def satisfies_b_def)
+apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
+done
+
+lemma (in M_satisfies) c_closed:
+     "[|M(A); x \<in> formula; y \<in> formula; M(rx); M(ry)|] 
+      ==> M(satisfies_c(A,x,y,rx,ry))"
+apply (simp add: satisfies_c_def) 
+apply (rule lam_closed2) 
+apply (rule Nand_replacement') 
+apply (simp_all add: formula_into_M list_into_M [of _ A])
+done
+
+lemma (in M_satisfies) c_rel:
+ "[|M(A); M(f)|] ==> 
+  Relation2 (M, formula, formula, 
+               satisfies_is_c(M,A,f),
+               \<lambda>u v. satisfies_c(A, u, v, f ` succ(depth(u)) ` u, 
+                                          f ` succ(depth(v)) ` v))"
+apply (simp add: Relation2_def satisfies_is_c_def satisfies_c_def)
+apply (auto del: iffI intro!: lambda_abs2 
+            simp add: Relation1_def formula_into_M) 
+done
+
+lemma (in M_satisfies) d_closed:
+     "[|M(A); x \<in> formula; M(rx)|] ==> M(satisfies_d(A,x,rx))"
+apply (simp add: satisfies_d_def) 
+apply (rule lam_closed2) 
+apply (rule Forall_replacement') 
+apply (simp_all add: formula_into_M list_into_M [of _ A])
+done
+
+lemma (in M_satisfies) d_rel:
+ "[|M(A); M(f)|] ==> 
+  Relation1(M, formula, satisfies_is_d(M,A,f), 
+     \<lambda>u. satisfies_d(A, u, f ` succ(depth(u)) ` u))"
+apply (simp del: rall_abs 
+            add: Relation1_def satisfies_is_d_def satisfies_d_def)
+apply (auto del: iffI intro!: lambda_abs2 simp add: Relation1_def) 
+done
+
+
+lemma (in M_satisfies) fr_replace:
+      "[|n \<in> nat; M(A)|] ==> transrec_replacement(M,satisfies_MH(M,A),n)" 
+by (blast intro: formula_rec_replacement) 
+
+lemma (in M_satisfies) formula_case_satisfies_closed:
+ "[|M(g); M(A); x \<in> formula|] ==>
+  M(formula_case (satisfies_a(A), satisfies_b(A),
+       \<lambda>u v. satisfies_c(A, u, v, 
+                         g ` succ(depth(u)) ` u, g ` succ(depth(v)) ` v),
+       \<lambda>u. satisfies_d (A, u, g ` succ(depth(u)) ` u),
+       x))"
+by (blast intro: a_closed b_closed c_closed d_closed) 
+
+lemma (in M_satisfies) fr_lam_replace:
+   "[|M(g); M(A)|] ==>
+    strong_replacement (M, \<lambda>x y. x \<in> formula &
+            y = \<langle>x, 
+                 formula_rec_case(satisfies_a(A),
+                                  satisfies_b(A),
+                                  satisfies_c(A),
+                                  satisfies_d(A), g, x)\<rangle>)"
+apply (insert formula_rec_lambda_replacement) 
+apply (simp add: formula_rec_case_def formula_case_satisfies_closed
+                 formula_case_abs [OF a_rel b_rel c_rel d_rel]) 
+done
+
+
+
+text\<open>Instantiate locale \<open>Formula_Rec\<close> for the 
+      Function \<^term>\<open>satisfies\<close>\<close>
+
+lemma (in M_satisfies) Formula_Rec_axioms_M:
+   "M(A) ==>
+    Formula_Rec_axioms(M, satisfies_a(A), satisfies_is_a(M,A), 
+                          satisfies_b(A), satisfies_is_b(M,A), 
+                          satisfies_c(A), satisfies_is_c(M,A), 
+                          satisfies_d(A), satisfies_is_d(M,A))"
+apply (rule Formula_Rec_axioms.intro)
+apply (assumption | 
+       rule a_closed a_rel b_closed b_rel c_closed c_rel d_closed d_rel
+       fr_replace [unfolded satisfies_MH_def]
+       fr_lam_replace) +
+done
+
+
+theorem (in M_satisfies) Formula_Rec_M: 
+    "M(A) ==>
+     Formula_Rec(M, satisfies_a(A), satisfies_is_a(M,A), 
+                         satisfies_b(A), satisfies_is_b(M,A), 
+                         satisfies_c(A), satisfies_is_c(M,A), 
+                         satisfies_d(A), satisfies_is_d(M,A))"
+  apply (rule Formula_Rec.intro)
+   apply (rule M_satisfies.axioms, rule M_satisfies_axioms, rule M_datatypes_axioms)
+  apply (erule Formula_Rec_axioms_M) 
+  done
+
+lemmas (in M_satisfies) 
+    satisfies_closed' = Formula_Rec.formula_rec_closed [OF Formula_Rec_M]
+and satisfies_abs'    = Formula_Rec.formula_rec_abs [OF Formula_Rec_M]
+
+
+lemma (in M_satisfies) satisfies_closed:
+  "[|M(A); p \<in> formula|] ==> M(satisfies(A,p))"
+by (simp add: Formula_Rec.formula_rec_closed [OF Formula_Rec_M]  
+              satisfies_eq) 
+
+lemma (in M_satisfies) satisfies_abs:
+  "[|M(A); M(z); p \<in> formula|] 
+   ==> is_satisfies(M,A,p,z) \<longleftrightarrow> z = satisfies(A,p)"
+by (simp only: Formula_Rec.formula_rec_abs [OF Formula_Rec_M]  
+               satisfies_eq is_satisfies_def satisfies_MH_def)
+
+
+subsection\<open>Internalizations Needed to Instantiate \<open>M_satisfies\<close>\<close>
+
+subsubsection\<open>The Operator \<^term>\<open>is_depth_apply\<close>, Internalized\<close>
+
+(* is_depth_apply(M,h,p,z) ==
+    \<exists>dp[M]. \<exists>sdp[M]. \<exists>hsdp[M]. 
+      2        1         0
+        finite_ordinal(M,dp) & is_depth(M,p,dp) & successor(M,dp,sdp) &
+        fun_apply(M,h,sdp,hsdp) & fun_apply(M,hsdp,p,z) *)
+definition
+  depth_apply_fm :: "[i,i,i]=>i" where
+    "depth_apply_fm(h,p,z) ==
+       Exists(Exists(Exists(
+        And(finite_ordinal_fm(2),
+         And(depth_fm(p#+3,2),
+          And(succ_fm(2,1),
+           And(fun_apply_fm(h#+3,1,0), fun_apply_fm(0,p#+3,z#+3))))))))"
+
+lemma depth_apply_type [TC]:
+     "[| x \<in> nat; y \<in> nat; z \<in> nat |] ==> depth_apply_fm(x,y,z) \<in> formula"
+by (simp add: depth_apply_fm_def)
+
+lemma sats_depth_apply_fm [simp]:
+   "[| x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, depth_apply_fm(x,y,z), env) \<longleftrightarrow>
+        is_depth_apply(##A, nth(x,env), nth(y,env), nth(z,env))"
+by (simp add: depth_apply_fm_def is_depth_apply_def)
+
+lemma depth_apply_iff_sats:
+    "[| nth(i,env) = x; nth(j,env) = y; nth(k,env) = z;
+        i \<in> nat; j \<in> nat; k \<in> nat; env \<in> list(A)|]
+     ==> is_depth_apply(##A, x, y, z) \<longleftrightarrow> sats(A, depth_apply_fm(i,j,k), env)"
+by simp
+
+lemma depth_apply_reflection:
+     "REFLECTS[\<lambda>x. is_depth_apply(L,f(x),g(x),h(x)),
+               \<lambda>i x. is_depth_apply(##Lset(i),f(x),g(x),h(x))]"
+apply (simp only: is_depth_apply_def)
+apply (intro FOL_reflections function_reflections depth_reflection 
+             finite_ordinal_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>satisfies_is_a\<close>, Internalized\<close>
+
+(* satisfies_is_a(M,A) == 
+    \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. is_bool_of_o(M, 
+                      \<exists>nx[M]. \<exists>ny[M]. 
+                       is_nth(M,x,env,nx) & is_nth(M,y,env,ny) & nx \<in> ny, z),
+                zz)  *)
+
+definition
+  satisfies_is_a_fm :: "[i,i,i,i]=>i" where
+  "satisfies_is_a_fm(A,x,y,z) ==
+   Forall(
+     Implies(is_list_fm(succ(A),0),
+       lambda_fm(
+         bool_of_o_fm(Exists(
+                       Exists(And(nth_fm(x#+6,3,1), 
+                               And(nth_fm(y#+6,3,0), 
+                                   Member(1,0))))), 0), 
+         0, succ(z))))"
+
+lemma satisfies_is_a_type [TC]:
+     "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
+      ==> satisfies_is_a_fm(A,x,y,z) \<in> formula"
+by (simp add: satisfies_is_a_fm_def)
+
+lemma sats_satisfies_is_a_fm [simp]:
+   "[| u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_is_a_fm(u,x,y,z), env) \<longleftrightarrow>
+        satisfies_is_a(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=x in lt_length_in_nat, assumption)  
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: satisfies_is_a_fm_def satisfies_is_a_def sats_lambda_fm 
+                 sats_bool_of_o_fm)
+done
+
+lemma satisfies_is_a_iff_sats:
+  "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
+      u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
+   ==> satisfies_is_a(##A,nu,nx,ny,nz) \<longleftrightarrow>
+       sats(A, satisfies_is_a_fm(u,x,y,z), env)"
+by simp
+
+theorem satisfies_is_a_reflection:
+     "REFLECTS[\<lambda>x. satisfies_is_a(L,f(x),g(x),h(x),g'(x)),
+               \<lambda>i x. satisfies_is_a(##Lset(i),f(x),g(x),h(x),g'(x))]"
+apply (unfold satisfies_is_a_def) 
+apply (intro FOL_reflections is_lambda_reflection bool_of_o_reflection 
+             nth_reflection is_list_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>satisfies_is_b\<close>, Internalized\<close>
+
+(* satisfies_is_b(M,A) == 
+    \<lambda>x y zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. is_bool_of_o(M, 
+                      \<exists>nx[M]. is_nth(M,x,env,nx) & is_nth(M,y,env,nx), z),
+                zz) *)
+
+definition
+  satisfies_is_b_fm :: "[i,i,i,i]=>i" where
+ "satisfies_is_b_fm(A,x,y,z) ==
+   Forall(
+     Implies(is_list_fm(succ(A),0),
+       lambda_fm(
+         bool_of_o_fm(Exists(And(nth_fm(x#+5,2,0), nth_fm(y#+5,2,0))), 0), 
+         0, succ(z))))"
+
+lemma satisfies_is_b_type [TC]:
+     "[| A \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
+      ==> satisfies_is_b_fm(A,x,y,z) \<in> formula"
+by (simp add: satisfies_is_b_fm_def)
+
+lemma sats_satisfies_is_b_fm [simp]:
+   "[| u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_is_b_fm(u,x,y,z), env) \<longleftrightarrow>
+        satisfies_is_b(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"
+apply (frule_tac x=x in lt_length_in_nat, assumption)  
+apply (frule_tac x=y in lt_length_in_nat, assumption)  
+apply (simp add: satisfies_is_b_fm_def satisfies_is_b_def sats_lambda_fm 
+                 sats_bool_of_o_fm)
+done
+
+lemma satisfies_is_b_iff_sats:
+  "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
+      u \<in> nat; x < length(env); y < length(env); z \<in> nat; env \<in> list(A)|]
+   ==> satisfies_is_b(##A,nu,nx,ny,nz) \<longleftrightarrow>
+       sats(A, satisfies_is_b_fm(u,x,y,z), env)"
+by simp
+
+theorem satisfies_is_b_reflection:
+     "REFLECTS[\<lambda>x. satisfies_is_b(L,f(x),g(x),h(x),g'(x)),
+               \<lambda>i x. satisfies_is_b(##Lset(i),f(x),g(x),h(x),g'(x))]"
+apply (unfold satisfies_is_b_def) 
+apply (intro FOL_reflections is_lambda_reflection bool_of_o_reflection 
+             nth_reflection is_list_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>satisfies_is_c\<close>, Internalized\<close>
+
+(* satisfies_is_c(M,A,h) == 
+    \<lambda>p q zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, \<lambda>env z. \<exists>hp[M]. \<exists>hq[M]. 
+                 (\<exists>rp[M]. is_depth_apply(M,h,p,rp) & fun_apply(M,rp,env,hp)) & 
+                 (\<exists>rq[M]. is_depth_apply(M,h,q,rq) & fun_apply(M,rq,env,hq)) & 
+                 (\<exists>pq[M]. is_and(M,hp,hq,pq) & is_not(M,pq,z)),
+                zz) *)
+
+definition
+  satisfies_is_c_fm :: "[i,i,i,i,i]=>i" where
+ "satisfies_is_c_fm(A,h,p,q,zz) ==
+   Forall(
+     Implies(is_list_fm(succ(A),0),
+       lambda_fm(
+         Exists(Exists(
+          And(Exists(And(depth_apply_fm(h#+7,p#+7,0), fun_apply_fm(0,4,2))),
+          And(Exists(And(depth_apply_fm(h#+7,q#+7,0), fun_apply_fm(0,4,1))),
+              Exists(And(and_fm(2,1,0), not_fm(0,3))))))),
+         0, succ(zz))))"
+
+lemma satisfies_is_c_type [TC]:
+     "[| A \<in> nat; h \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat |]
+      ==> satisfies_is_c_fm(A,h,x,y,z) \<in> formula"
+by (simp add: satisfies_is_c_fm_def)
+
+lemma sats_satisfies_is_c_fm [simp]:
+   "[| u \<in> nat; v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_is_c_fm(u,v,x,y,z), env) \<longleftrightarrow>
+        satisfies_is_c(##A, nth(u,env), nth(v,env), nth(x,env), 
+                            nth(y,env), nth(z,env))"  
+by (simp add: satisfies_is_c_fm_def satisfies_is_c_def sats_lambda_fm)
+
+lemma satisfies_is_c_iff_sats:
+  "[| nth(u,env) = nu; nth(v,env) = nv; nth(x,env) = nx; nth(y,env) = ny; 
+      nth(z,env) = nz;
+      u \<in> nat; v \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+   ==> satisfies_is_c(##A,nu,nv,nx,ny,nz) \<longleftrightarrow>
+       sats(A, satisfies_is_c_fm(u,v,x,y,z), env)"
+by simp
+
+theorem satisfies_is_c_reflection:
+     "REFLECTS[\<lambda>x. satisfies_is_c(L,f(x),g(x),h(x),g'(x),h'(x)),
+               \<lambda>i x. satisfies_is_c(##Lset(i),f(x),g(x),h(x),g'(x),h'(x))]"
+apply (unfold satisfies_is_c_def) 
+apply (intro FOL_reflections function_reflections is_lambda_reflection
+             extra_reflections nth_reflection depth_apply_reflection 
+             is_list_reflection)
+done
+
+subsubsection\<open>The Operator \<^term>\<open>satisfies_is_d\<close>, Internalized\<close>
+
+(* satisfies_is_d(M,A,h) == 
+    \<lambda>p zz. \<forall>lA[M]. is_list(M,A,lA) \<longrightarrow>
+             is_lambda(M, lA, 
+                \<lambda>env z. \<exists>rp[M]. is_depth_apply(M,h,p,rp) & 
+                    is_bool_of_o(M, 
+                           \<forall>x[M]. \<forall>xenv[M]. \<forall>hp[M]. 
+                              x\<in>A \<longrightarrow> is_Cons(M,x,env,xenv) \<longrightarrow> 
+                              fun_apply(M,rp,xenv,hp) \<longrightarrow> number1(M,hp),
+                  z),
+               zz) *)
+
+definition
+  satisfies_is_d_fm :: "[i,i,i,i]=>i" where
+ "satisfies_is_d_fm(A,h,p,zz) ==
+   Forall(
+     Implies(is_list_fm(succ(A),0),
+       lambda_fm(
+         Exists(
+           And(depth_apply_fm(h#+5,p#+5,0),
+               bool_of_o_fm(
+                Forall(Forall(Forall(
+                 Implies(Member(2,A#+8),
+                  Implies(Cons_fm(2,5,1),
+                   Implies(fun_apply_fm(3,1,0), number1_fm(0))))))), 1))),
+         0, succ(zz))))"
+
+lemma satisfies_is_d_type [TC]:
+     "[| A \<in> nat; h \<in> nat; x \<in> nat; z \<in> nat |]
+      ==> satisfies_is_d_fm(A,h,x,z) \<in> formula"
+by (simp add: satisfies_is_d_fm_def)
+
+lemma sats_satisfies_is_d_fm [simp]:
+   "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_is_d_fm(u,x,y,z), env) \<longleftrightarrow>
+        satisfies_is_d(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"  
+by (simp add: satisfies_is_d_fm_def satisfies_is_d_def sats_lambda_fm
+              sats_bool_of_o_fm)
+
+lemma satisfies_is_d_iff_sats:
+  "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
+      u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+   ==> satisfies_is_d(##A,nu,nx,ny,nz) \<longleftrightarrow>
+       sats(A, satisfies_is_d_fm(u,x,y,z), env)"
+by simp
+
+theorem satisfies_is_d_reflection:
+     "REFLECTS[\<lambda>x. satisfies_is_d(L,f(x),g(x),h(x),g'(x)),
+               \<lambda>i x. satisfies_is_d(##Lset(i),f(x),g(x),h(x),g'(x))]"
+apply (unfold satisfies_is_d_def) 
+apply (intro FOL_reflections function_reflections is_lambda_reflection
+             extra_reflections nth_reflection depth_apply_reflection 
+             is_list_reflection)
+done
+
+
+subsubsection\<open>The Operator \<^term>\<open>satisfies_MH\<close>, Internalized\<close>
+
+(* satisfies_MH == 
+    \<lambda>M A u f zz. 
+         \<forall>fml[M]. is_formula(M,fml) \<longrightarrow>
+             is_lambda (M, fml, 
+               is_formula_case (M, satisfies_is_a(M,A), 
+                                satisfies_is_b(M,A), 
+                                satisfies_is_c(M,A,f), satisfies_is_d(M,A,f)),
+               zz) *)
+
+definition
+  satisfies_MH_fm :: "[i,i,i,i]=>i" where
+ "satisfies_MH_fm(A,u,f,zz) ==
+   Forall(
+     Implies(is_formula_fm(0),
+       lambda_fm(
+         formula_case_fm(satisfies_is_a_fm(A#+7,2,1,0), 
+                         satisfies_is_b_fm(A#+7,2,1,0), 
+                         satisfies_is_c_fm(A#+7,f#+7,2,1,0), 
+                         satisfies_is_d_fm(A#+6,f#+6,1,0), 
+                         1, 0),
+         0, succ(zz))))"
+
+lemma satisfies_MH_type [TC]:
+     "[| A \<in> nat; u \<in> nat; x \<in> nat; z \<in> nat |]
+      ==> satisfies_MH_fm(A,u,x,z) \<in> formula"
+by (simp add: satisfies_MH_fm_def)
+
+lemma sats_satisfies_MH_fm [simp]:
+   "[| u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+    ==> sats(A, satisfies_MH_fm(u,x,y,z), env) \<longleftrightarrow>
+        satisfies_MH(##A, nth(u,env), nth(x,env), nth(y,env), nth(z,env))"  
+by (simp add: satisfies_MH_fm_def satisfies_MH_def sats_lambda_fm
+              sats_formula_case_fm)
+
+lemma satisfies_MH_iff_sats:
+  "[| nth(u,env) = nu; nth(x,env) = nx; nth(y,env) = ny; nth(z,env) = nz;
+      u \<in> nat; x \<in> nat; y \<in> nat; z \<in> nat; env \<in> list(A)|]
+   ==> satisfies_MH(##A,nu,nx,ny,nz) \<longleftrightarrow>
+       sats(A, satisfies_MH_fm(u,x,y,z), env)"
+by simp 
+
+lemmas satisfies_reflections =
+       is_lambda_reflection is_formula_reflection 
+       is_formula_case_reflection
+       satisfies_is_a_reflection satisfies_is_b_reflection 
+       satisfies_is_c_reflection satisfies_is_d_reflection
+
+theorem satisfies_MH_reflection:
+     "REFLECTS[\<lambda>x. satisfies_MH(L,f(x),g(x),h(x),g'(x)),
+               \<lambda>i x. satisfies_MH(##Lset(i),f(x),g(x),h(x),g'(x))]"
+apply (unfold satisfies_MH_def) 
+apply (intro FOL_reflections satisfies_reflections)
+done
+
+
+subsection\<open>Lemmas for Instantiating the Locale \<open>M_satisfies\<close>\<close>
+
+
+subsubsection\<open>The \<^term>\<open>Member\<close> Case\<close>
+
+lemma Member_Reflects:
+ "REFLECTS[\<lambda>u. \<exists>v[L]. v \<in> B \<and> (\<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L].
+          v \<in> lstA \<and> is_nth(L,x,v,nx) \<and> is_nth(L,y,v,ny) \<and>
+          is_bool_of_o(L, nx \<in> ny, bo) \<and> pair(L,v,bo,u)),
+   \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B \<and> (\<exists>bo \<in> Lset(i). \<exists>nx \<in> Lset(i). \<exists>ny \<in> Lset(i).
+             v \<in> lstA \<and> is_nth(##Lset(i), x, v, nx) \<and> 
+             is_nth(##Lset(i), y, v, ny) \<and>
+          is_bool_of_o(##Lset(i), nx \<in> ny, bo) \<and> pair(##Lset(i), v, bo, u))]"
+by (intro FOL_reflections function_reflections nth_reflection 
+          bool_of_o_reflection)
+
+
+lemma Member_replacement:
+    "[|L(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (L, \<lambda>env z. \<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L]. 
+              env \<in> list(A) & is_nth(L,x,env,nx) & is_nth(L,y,env,ny) & 
+              is_bool_of_o(L, nx \<in> ny, bo) &
+              pair(L, env, bo, z))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{list(A),B,x,y}" 
+         in gen_separation_multi [OF Member_Reflects], 
+       auto)
+apply (rule_tac env="[list(A),B,x,y]" in DPow_LsetI)
+apply (rule sep_rules nth_iff_sats is_bool_of_o_iff_sats | simp)+
+done
+
+
+subsubsection\<open>The \<^term>\<open>Equal\<close> Case\<close>
+
+lemma Equal_Reflects:
+ "REFLECTS[\<lambda>u. \<exists>v[L]. v \<in> B \<and> (\<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L].
+          v \<in> lstA \<and> is_nth(L, x, v, nx) \<and> is_nth(L, y, v, ny) \<and>
+          is_bool_of_o(L, nx = ny, bo) \<and> pair(L, v, bo, u)),
+   \<lambda>i u. \<exists>v \<in> Lset(i). v \<in> B \<and> (\<exists>bo \<in> Lset(i). \<exists>nx \<in> Lset(i). \<exists>ny \<in> Lset(i).
+             v \<in> lstA \<and> is_nth(##Lset(i), x, v, nx) \<and> 
+             is_nth(##Lset(i), y, v, ny) \<and>
+          is_bool_of_o(##Lset(i), nx = ny, bo) \<and> pair(##Lset(i), v, bo, u))]"
+by (intro FOL_reflections function_reflections nth_reflection 
+          bool_of_o_reflection)
+
+
+lemma Equal_replacement:
+    "[|L(A); x \<in> nat; y \<in> nat|]
+     ==> strong_replacement
+         (L, \<lambda>env z. \<exists>bo[L]. \<exists>nx[L]. \<exists>ny[L]. 
+              env \<in> list(A) & is_nth(L,x,env,nx) & is_nth(L,y,env,ny) & 
+              is_bool_of_o(L, nx = ny, bo) &
+              pair(L, env, bo, z))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{list(A),B,x,y}" 
+         in gen_separation_multi [OF Equal_Reflects], 
+       auto)
+apply (rule_tac env="[list(A),B,x,y]" in DPow_LsetI)
+apply (rule sep_rules nth_iff_sats is_bool_of_o_iff_sats | simp)+
+done
+
+subsubsection\<open>The \<^term>\<open>Nand\<close> Case\<close>
+
+lemma Nand_Reflects:
+    "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and>
+               (\<exists>rpe[L]. \<exists>rqe[L]. \<exists>andpq[L]. \<exists>notpq[L].
+                 fun_apply(L, rp, u, rpe) \<and> fun_apply(L, rq, u, rqe) \<and>
+                 is_and(L, rpe, rqe, andpq) \<and> is_not(L, andpq, notpq) \<and>
+                 u \<in> list(A) \<and> pair(L, u, notpq, x)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and>
+     (\<exists>rpe \<in> Lset(i). \<exists>rqe \<in> Lset(i). \<exists>andpq \<in> Lset(i). \<exists>notpq \<in> Lset(i).
+       fun_apply(##Lset(i), rp, u, rpe) \<and> fun_apply(##Lset(i), rq, u, rqe) \<and>
+       is_and(##Lset(i), rpe, rqe, andpq) \<and> is_not(##Lset(i), andpq, notpq) \<and>
+       u \<in> list(A) \<and> pair(##Lset(i), u, notpq, x))]"
+apply (unfold is_and_def is_not_def) 
+apply (intro FOL_reflections function_reflections)
+done
+
+lemma Nand_replacement:
+    "[|L(A); L(rp); L(rq)|]
+     ==> strong_replacement
+         (L, \<lambda>env z. \<exists>rpe[L]. \<exists>rqe[L]. \<exists>andpq[L]. \<exists>notpq[L]. 
+               fun_apply(L,rp,env,rpe) & fun_apply(L,rq,env,rqe) & 
+               is_and(L,rpe,rqe,andpq) & is_not(L,andpq,notpq) & 
+               env \<in> list(A) & pair(L, env, notpq, z))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{list(A),B,rp,rq}" 
+         in gen_separation_multi [OF Nand_Reflects],
+       auto)
+apply (rule_tac env="[list(A),B,rp,rq]" in DPow_LsetI)
+apply (rule sep_rules is_and_iff_sats is_not_iff_sats | simp)+
+done
+
+
+subsubsection\<open>The \<^term>\<open>Forall\<close> Case\<close>
+
+lemma Forall_Reflects:
+ "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>bo[L]. u \<in> list(A) \<and>
+                 is_bool_of_o (L,
+     \<forall>a[L]. \<forall>co[L]. \<forall>rpco[L]. a \<in> A \<longrightarrow>
+                is_Cons(L,a,u,co) \<longrightarrow> fun_apply(L,rp,co,rpco) \<longrightarrow> 
+                number1(L,rpco),
+                           bo) \<and> pair(L,u,bo,x)),
+ \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>bo \<in> Lset(i). u \<in> list(A) \<and>
+        is_bool_of_o (##Lset(i),
+ \<forall>a \<in> Lset(i). \<forall>co \<in> Lset(i). \<forall>rpco \<in> Lset(i). a \<in> A \<longrightarrow>
+            is_Cons(##Lset(i),a,u,co) \<longrightarrow> fun_apply(##Lset(i),rp,co,rpco) \<longrightarrow> 
+            number1(##Lset(i),rpco),
+                       bo) \<and> pair(##Lset(i),u,bo,x))]"
+apply (unfold is_bool_of_o_def) 
+apply (intro FOL_reflections function_reflections Cons_reflection)
+done
+
+lemma Forall_replacement:
+   "[|L(A); L(rp)|]
+    ==> strong_replacement
+        (L, \<lambda>env z. \<exists>bo[L]. 
+              env \<in> list(A) & 
+              is_bool_of_o (L, 
+                            \<forall>a[L]. \<forall>co[L]. \<forall>rpco[L]. 
+                               a\<in>A \<longrightarrow> is_Cons(L,a,env,co) \<longrightarrow>
+                               fun_apply(L,rp,co,rpco) \<longrightarrow> number1(L, rpco), 
+                            bo) &
+              pair(L,env,bo,z))"
+apply (rule strong_replacementI)
+apply (rule_tac u="{A,list(A),B,rp}" 
+         in gen_separation_multi [OF Forall_Reflects],
+       auto)
+apply (rule_tac env="[A,list(A),B,rp]" in DPow_LsetI)
+apply (rule sep_rules is_bool_of_o_iff_sats Cons_iff_sats | simp)+
+done
+
+subsubsection\<open>The \<^term>\<open>transrec_replacement\<close> Case\<close>
+
+lemma formula_rec_replacement_Reflects:
+ "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B \<and> (\<exists>y[L]. pair(L, u, y, x) \<and>
+             is_wfrec (L, satisfies_MH(L,A), mesa, u, y)),
+    \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B \<and> (\<exists>y \<in> Lset(i). pair(##Lset(i), u, y, x) \<and>
+             is_wfrec (##Lset(i), satisfies_MH(##Lset(i),A), mesa, u, y))]"
+by (intro FOL_reflections function_reflections satisfies_MH_reflection 
+          is_wfrec_reflection) 
+
+lemma formula_rec_replacement: 
+      \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
+   "[|n \<in> nat; L(A)|] ==> transrec_replacement(L, satisfies_MH(L,A), n)"
+apply (rule L.transrec_replacementI, simp add: L.nat_into_M)
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,A,n,Memrel(eclose({n}))}"
+         in gen_separation_multi [OF formula_rec_replacement_Reflects],
+       auto simp add: L.nat_into_M)
+apply (rule_tac env="[B,A,n,Memrel(eclose({n}))]" in DPow_LsetI)
+apply (rule sep_rules satisfies_MH_iff_sats is_wfrec_iff_sats | simp)+
+done
+
+
+subsubsection\<open>The Lambda Replacement Case\<close>
+
+lemma formula_rec_lambda_replacement_Reflects:
+ "REFLECTS [\<lambda>x. \<exists>u[L]. u \<in> B &
+     mem_formula(L,u) &
+     (\<exists>c[L].
+         is_formula_case
+          (L, satisfies_is_a(L,A), satisfies_is_b(L,A),
+           satisfies_is_c(L,A,g), satisfies_is_d(L,A,g),
+           u, c) &
+         pair(L,u,c,x)),
+  \<lambda>i x. \<exists>u \<in> Lset(i). u \<in> B & mem_formula(##Lset(i),u) &
+     (\<exists>c \<in> Lset(i).
+         is_formula_case
+          (##Lset(i), satisfies_is_a(##Lset(i),A), satisfies_is_b(##Lset(i),A),
+           satisfies_is_c(##Lset(i),A,g), satisfies_is_d(##Lset(i),A,g),
+           u, c) &
+         pair(##Lset(i),u,c,x))]"
+by (intro FOL_reflections function_reflections mem_formula_reflection
+          is_formula_case_reflection satisfies_is_a_reflection
+          satisfies_is_b_reflection satisfies_is_c_reflection
+          satisfies_is_d_reflection)  
+
+lemma formula_rec_lambda_replacement: 
+      \<comment> \<open>For the \<^term>\<open>transrec\<close>\<close>
+   "[|L(g); L(A)|] ==>
+    strong_replacement (L, 
+       \<lambda>x y. mem_formula(L,x) &
+             (\<exists>c[L]. is_formula_case(L, satisfies_is_a(L,A),
+                                  satisfies_is_b(L,A),
+                                  satisfies_is_c(L,A,g),
+                                  satisfies_is_d(L,A,g), x, c) &
+             pair(L, x, c, y)))" 
+apply (rule strong_replacementI)
+apply (rule_tac u="{B,A,g}"
+         in gen_separation_multi [OF formula_rec_lambda_replacement_Reflects], 
+       auto)
+apply (rule_tac env="[A,g,B]" in DPow_LsetI)
+apply (rule sep_rules mem_formula_iff_sats
+          formula_case_iff_sats satisfies_is_a_iff_sats
+          satisfies_is_b_iff_sats satisfies_is_c_iff_sats
+          satisfies_is_d_iff_sats | simp)+
+done
+
+
+subsection\<open>Instantiating \<open>M_satisfies\<close>\<close>
+
+lemma M_satisfies_axioms_L: "M_satisfies_axioms(L)"
+  apply (rule M_satisfies_axioms.intro)
+       apply (assumption | rule
+         Member_replacement Equal_replacement 
+         Nand_replacement Forall_replacement
+         formula_rec_replacement formula_rec_lambda_replacement)+
+  done
+
+theorem M_satisfies_L: "M_satisfies(L)"
+  apply (rule M_satisfies.intro)
+   apply (rule M_eclose_L)
+   apply (rule M_datatypes_L)
+  apply (rule M_satisfies_axioms_L)
+  done
+
+text\<open>Finally: the point of the whole theory!\<close>
+lemmas satisfies_closed = M_satisfies.satisfies_closed [OF M_satisfies_L]
+   and satisfies_abs = M_satisfies.satisfies_abs [OF M_satisfies_L]
+
+end